stcorp / harp

Data harmonization toolset for scientific earth observation data
http://stcorp.github.io/harp/doc/html/index.html
BSD 3-Clause "New" or "Revised" License
55 stars 18 forks source link

Fix uninitialized read in harp_operation_string_comparison_filter_new #266

Closed Teemperor closed 2 years ago

Teemperor commented 2 years ago

This code malloc's a harp_operation_string_comparison_filter and then directly initializes all fields aside from value. Afterwards it tries to strdup variable_name and if that fails (due to a out-of-memory error) it will error out and cleanup the allocated struct via string_comparison_filter_delete.

string_comparison_filter_delete does the following check on the passed in struct where it will free the memory behind value if it's not NULL:

        if (operation->value != NULL)
        {
            free(operation->value);
        }

However, because value is not initialized yet, this code actually randomly calls free with the uninitialized pointer value as the argument.

svniemeijer commented 2 years ago

Good catch!