search

vmihalko / t2_polkit

Other
0 stars 0 forks source link

Coverity scan detection: jsauthority potential memleak - [closed] #303

Closed vmihalko closed 1 year ago

vmihalko commented 3 years ago

In GitLab by @jrybar on Aug 10, 2021, 18:16

Merges covscan-jsauthority-memleak -> master

Detection found by static analysis

vmihalko commented 3 years ago

In GitLab by @halfline on Aug 11, 2021, 04:23

Commented on src/polkitbackend/polkitbackendjsauthority.cpp line 1735

this needs to be null initialized if you're going to free it unconditionally i think

vmihalko commented 3 years ago

In GitLab by @halfline on Aug 11, 2021, 04:29

i think this is probably a false positive to be honest. i doubt buf will ever get touched unless the condition evaluates to true.

could use g_autofree i suppose

vmihalko commented 3 years ago

In GitLab by @jrybar on Aug 11, 2021, 10:16

Commented on src/polkitbackend/polkitbackendjsauthority.cpp line 1735

true

vmihalko commented 3 years ago

In GitLab by @jrybar on Aug 11, 2021, 10:18

I thought the very same at first (and with this in mind I closed the related bugzilla), but then I realized that if the _read_to_end() ends prematurely with an error, the allocated memory pointed by *buf does not get wiped (as it's only freed if condition succeeds). According to the scarse documentation I was able to find, nothing says this is sanitized. On the other hand g_free() simply returns if *buf is already null, so there's nothing to lose.

vmihalko commented 3 years ago

In GitLab by @jrybar on Aug 12, 2021, 14:30

OK, after seeing the code of giochannel.c, I can confirm that the Glib function returns safe output, hence this can be really closed as false positive.