#1234 sss_getautomntent_data_save operates on pointer address, not contents
Closed: Fixed None Opened 12 years ago by jhrozek.

314    /* Got reply, let's save it and return from "cache" */
CID 12568: Free of address-of expression (BAD_FREE)"sss_getautomntent_data_save" frees address of "repbuf". [hide details]
315    ret = sss_getautomntent_data_save(ctx->mapname, &repbuf, replen);

The function details:

217sss_getautomntent_data_save(const char *mapname, uint8_t **repbuf, size_t replen)
218{
219    size_t rp;
220    uint32_t num;
221
222    rp = 0;
223    SAFEALIGN_COPY_UINT32(&num, repbuf+rp, &rp);
At conditional (1): "num == 0U" taking the true branch.
224    if (num == 0) {
"free" frees parameter "repbuf".
225        free(repbuf);
226        return ENOENT;
227    }

We need to free(*repbuf)


Fields changed

keywords: => Coverity

Fields changed

owner: => jhrozek
patch: 0 => 1

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.8.1 (LTM)

Fields changed

rhbz: => 0

resolution: => fixed
status: new => closed

Metadata Update from @jhrozek:
- Issue assigned to jhrozek
- Issue set to the milestone: SSSD 1.8.1 (LTM)

7 years ago

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/2276

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Login to comment on this ticket.

Metadata