portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Various Coverity fixes (#2615)

Browse source 
* Fix CID 392733 - memory leak

* Fix CID 392732 - memory leak

* Fix CID 392730 - memory leak

* Fix CID 392729 - memory leak

* Fix `rz_analysis_diff_free()` API function

* Fix CID 392685 - memory leak

* Fix CID 392012 - use after free

* Fix CID 391968 - uninitialized pointer read

* Fix CID 391966 - memory leak

* Fix CID 391964 - uninitialized pointer read

* Fix CID 390013 - memory leak

* Fix CID 389939 - memory leak

* Fix CID 379249 - memory leak

* Fix CID 378881 - uninitialized scalar variable

* Fix CID 378973 - uninitialized scalar variable

* Fix CID 378850 - uninitialized scalar variable

* Fix CID 371079 - memory leak

* Fix CID 367478 - memory leak

* Fix CID 366821 - memory leak

* Fix CID 366736 - memory leak

* Fix CID 361684 - uninitialized scalar value

* Fix CID 352581 - memory leak

* Fix CID 352557 - memory leak

* Fix CID 348937 - memory leak

* Fix CID 322229 - memory leak

* Fix CID 320122 - memory leak

* Fix CID 317611 - memory leak
This commit is contained in:
Anton Kochkov 2022-05-15 23:15:28 +08:00 committed by GitHub
parent 686470522e
commit 2188b4564d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
26 changed files with 69 additions and 35 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
librz/analysis/diff.c
View file

@ -6,24 +6,25 @@
#include <rz_util.h>
#include <rz_diff.h>
RZ_API RzAnalysisDiff *rz_analysis_diff_new(void) {
RZ_API RZ_OWN RzAnalysisDiff *rz_analysis_diff_new(void) {
RzAnalysisDiff *diff = RZ_NEW0(RzAnalysisDiff);
if (diff) {
diff->type = RZ_ANALYSIS_DIFF_TYPE_NULL;
diff->addr = UT64_MAX;
diff->dist = 0;
diff->name = NULL;
diff->size = 0;
if (!diff) {
return NULL;
}
diff->type = RZ_ANALYSIS_DIFF_TYPE_NULL;
diff->addr = UT64_MAX;
diff->dist = 0;
diff->name = NULL;
diff->size = 0;
return diff;
}
RZ_API void *rz_analysis_diff_free(RzAnalysisDiff *diff) {
if (diff && diff->name) {
RZ_FREE(diff->name);
RZ_API void rz_analysis_diff_free(RzAnalysisDiff *diff) {
if (!diff) {
return;
}
free(diff->name);
free(diff);
return NULL;
}
/* 0-1 */

2
librz/analysis/dwarf_process.c
View file

@ -457,7 +457,9 @@ static RzTypeStructMember *parse_struct_member(Context *ctx, ut64 idx, RzTypeStr
}
result->offset = offset;
result->size = size;
free(type);
return result;
cleanup:
free(name);
free(type);

2
librz/bin/bin.c
View file

@ -714,7 +714,7 @@ RZ_API RzBinMap *rz_bin_object_get_map_at(RzBinObject *o, ut64 off, bool va) {
* \param va When false the offset \p off is considered a physical address, otherwise a virtual address
* \return Vector of \p RzBinMap pointers
*/
RZ_API RzPVector *rz_bin_object_get_maps_at(RzBinObject *o, ut64 off, bool va) {
RZ_API RZ_OWN RzPVector *rz_bin_object_get_maps_at(RzBinObject *o, ut64 off, bool va) {
rz_return_val_if_fail(o, NULL);
RzBinMap *map;

1
librz/bin/bobj.c
View file

@ -997,6 +997,7 @@ RZ_API RzVector *rz_bin_object_p2v_all(RzBinObject *obj, ut64 paddr) {
}
}
rz_pvector_free(maps);
return res;
}

1
librz/bin/dwarf.c
View file

@ -2092,6 +2092,7 @@ RZ_API RzBinDwarfDebugInfo *rz_bin_dwarf_parse_info(RzBinFile *binfile, RzBinDwa
info->lookup_table = ht_up_new_size(info->n_dwarf_dies, NULL, NULL, NULL);
if (!info->lookup_table) {
rz_bin_dwarf_debug_info_free(info);
info = NULL;
goto cave_buf;
}
// build hashtable after whole parsing because of possible relocations

2
librz/bin/format/mach0/dyldcache.c
View file

@ -253,7 +253,7 @@ objc_cache_opt_info *rz_dyldcache_get_objc_opt_info(RzBinFile *bf, RzDyldCache *
continue;
}
struct MACH0_(opts_t) opts;
struct MACH0_(opts_t) opts = { 0 };
opts.verbose = bf->rbin->verbose;
opts.header_at = bin->header_at;

1
librz/bin/golang.c
View file

@ -285,6 +285,7 @@ RZ_API RZ_OWN char *rz_bin_file_golang_compiler(RZ_NONNULL RzBinFile *bf) {
break;
}
}
rz_list_free(sections);
if (!go_info.version) {
return NULL;

5
librz/bin/p/bin_qnx.c
View file

@ -104,10 +104,11 @@ static bool load_buffer(RzBinFile *bf, RzBinObject *obj, RzBuffer *buf, Sdb *sdb
rz_list_append(maps, map);
} else if (lrec.rec_type == LMF_LOAD_REC) {
RzBinSection *ptr = RZ_NEW0(RzBinSection);
if (rz_buf_fread_at(bf->buf, offset, (ut8 *)&ldata, "si", 1) < sizeof(lmf_data)) {
if (!ptr) {
goto beach;
}
if (!ptr) {
if (rz_buf_fread_at(bf->buf, offset, (ut8 *)&ldata, "si", 1) < sizeof(lmf_data)) {
free(ptr);
goto beach;
}
ptr->name = strdup("LMF_LOAD");

3
librz/core/carg.c
View file

@ -286,6 +286,7 @@ RZ_API RZ_OWN RzList *rz_core_get_func_args(RzCore *core, const char *fcn_name)
const char *sp = rz_reg_get_name(core->analysis->reg, RZ_REG_NAME_SP);
int nargs = rz_type_func_args_count(core->analysis->typedb, key);
if (!rz_analysis_cc_func(core->analysis, key)) {
rz_list_free(list);
return NULL;
}
char *cc = strdup(rz_analysis_cc_func(core->analysis, key));
@ -293,6 +294,7 @@ RZ_API RZ_OWN RzList *rz_core_get_func_args(RzCore *core, const char *fcn_name)
if (!cc) {
// unsupported calling convention
free(key);
rz_list_free(list);
return NULL;
}
int i;
@ -311,6 +313,7 @@ RZ_API RZ_OWN RzList *rz_core_get_func_args(RzCore *core, const char *fcn_name)
RzAnalysisFuncArg *arg = RZ_NEW0(RzAnalysisFuncArg);
if (!arg) {
free(cc);
rz_list_free(list);
return NULL;
}
set_fcn_args_info(arg, core->analysis, key, cc, i);

1
librz/core/cmd/cmd.c
View file

@ -3678,6 +3678,7 @@ DEFINE_HANDLE_TS_FCN_AND_SYMBOL(arged_stmt) {
free(command_str);
res = core_cmd_tsrzcmd(state->core, exec_string, state->split_lines, false);
free(exec_string);
free(command_extra_str);
return res;
}

11
librz/core/cmd/cmd_analysis.c
View file

@ -1828,7 +1828,7 @@ RZ_IPI RzCmdStatus rz_analysis_continue_until_breakpoint_handler(RzCore *core, i
// aecs
RZ_IPI RzCmdStatus rz_analysis_continue_until_syscall_handler(RzCore *core, int argc, const char **argv) {
const char *pc = rz_reg_get_name(core->analysis->reg, RZ_REG_NAME_PC);
RzAnalysisOp *op;
RzAnalysisOp *op = NULL;
while (!rz_cons_is_breaked()) {
if (!rz_core_esil_step(core, UT64_MAX, NULL, NULL, false)) {
break;
@ -1862,7 +1862,7 @@ RZ_IPI RzCmdStatus rz_analysis_continue_until_syscall_handler(RzCore *core, int
// aecc
RZ_IPI RzCmdStatus rz_analysis_continue_until_call_handler(RzCore *core, int argc, const char **argv) {
const char *pc = rz_reg_get_name(core->analysis->reg, RZ_REG_NAME_PC);
RzAnalysisOp *op;
RzAnalysisOp *op = NULL;
while (!rz_cons_is_breaked()) {
if (!rz_core_esil_step(core, UT64_MAX, NULL, NULL, false)) {
break;
@ -2031,6 +2031,7 @@ RZ_IPI RzCmdStatus rz_il_step_until_expr_handler(RzCore *core, int argc, const c
RZ_IPI RzCmdStatus rz_il_step_until_opt_handler(RzCore *core, int argc, const char **argv) {
RzList *optypes_list = rz_list_new_from_array((const void **)&argv[1], argc - 1);
step_until_optype(core, optypes_list);
rz_list_free(optypes_list);
rz_core_reg_update_flags(core);
return RZ_CMD_STATUS_OK;
}
@ -5079,7 +5080,7 @@ RZ_IPI RzCmdStatus rz_analysis_xrefs_from_list_handler(RzCore *core, int argc, c
xref->type ? xref->type : ' ', xref->to, desc);
if (xref->type == RZ_ANALYSIS_XREF_TYPE_CALL) {
RzAnalysisOp aop;
RzAnalysisOp aop = { 0 };
rz_analysis_op(core->analysis, &aop, xref->to, buf, sizeof(buf), RZ_ANALYSIS_OP_MASK_BASIC);
if (aop.type == RZ_ANALYSIS_OP_TYPE_UCALL) {
cmd_analysis_ucall_ref(core, xref->to);
@ -5768,7 +5769,9 @@ RZ_IPI RzCmdStatus rz_analysis_function_list_ascii_handler(RzCore *core, int arg
RzTable *table = rz_core_table(core);
rz_table_visual_list(table, flist, core->offset, core->blocksize,
rz_cons_get_size(NULL), rz_config_get_i(core->config, "scr.color"));
rz_cons_printf("\n%s\n", rz_table_tostring(table));
char *tablestr = rz_table_tostring(table);
rz_cons_printf("\n%s\n", tablestr);
free(tablestr);
rz_table_free(table);
rz_list_free(flist);
rz_list_free(fcns);

5
librz/core/cmd/cmd_debug.c
View file

@ -192,6 +192,7 @@ struct trace_node {
static void set_profile_string(RzCore *core, const char *str) {
char *file = strdup(rz_config_get(core->config, "dbg.profile"));
if (RZ_STR_ISEMPTY(file)) {
free(file);
file = rz_file_temp("rz-run");
rz_config_set(core->config, "dbg.profile", file);
}
@ -482,7 +483,7 @@ RZ_API void rz_core_dbg_follow_seek_register(RzCore *core) {
rz_core_debug_sync_bits(core);
}
static int step_until_optype(RzCore *core, RzList *optypes_list) {
static bool step_until_optype(RzCore *core, RzList *optypes_list) {
RzAnalysisOp op;
ut8 buf[32];
ut64 pc;
@ -3465,10 +3466,12 @@ RZ_IPI RzCmdStatus rz_cmd_debug_process_profile_handler(RzCore *core, int argc,
for (i = 1; i < argc; i++) {
RzList *l = rz_str_split_duplist_n(argv[i], "=", 1, false);
if (!l) {
rz_list_free(list);
return RZ_CMD_STATUS_ERROR;
}
size_t llen = rz_list_length(l);
if (llen < 2) {
rz_list_free(list);
rz_list_free(l);
return RZ_CMD_STATUS_ERROR;
}

1
librz/core/cmd/cmd_flag.c
View file

@ -602,6 +602,7 @@ RZ_IPI RzCmdStatus rz_flag_tag_list_handler(RzCore *core, int argc, const char *
rz_list_foreach (list, iter, tag) {
flag_tag_print(core, tag, state);
}
rz_list_free(list);
rz_cmd_state_output_array_end(state);
return RZ_CMD_STATUS_OK;
}

1
librz/core/cmd/cmd_open.c
View file

@ -780,6 +780,7 @@ RZ_IPI RzCmdStatus rz_open_binary_file_handler(RzCore *core, int argc, const cha
RzBinFile *bf = rz_bin_open_io(core->bin, &opt);
rz_core_bin_apply_all_info(core, bf);
}
rz_list_free(files);
rz_io_desc_close(desc);
rz_io_use_fd(core->io, saved_fd);

4
librz/core/cmd/cmd_print.c
View file

@ -2626,7 +2626,9 @@ static ut8 *old_transform_op(RzCore *core, const char *val, char op, int *buflen
hexlen = rz_hex_str2bin(val, hex);
}
return rz_core_transform_op(core, core->offset, wop, hex, hexlen, buflen);
ut8 *result = rz_core_transform_op(core, core->offset, wop, hex, hexlen, buflen);
free(hex);
return result;
}
static void cmd_print_op(RzCore *core, const char *input) {

4
librz/core/cmd/cmd_search.c
View file

@ -349,12 +349,14 @@ RZ_API int rz_core_search_preludes(RzCore *core, bool log) {
keyword = malloc(strlen(prelude) + 1);
if (!keyword) {
RZ_LOG_ERROR("aap: cannot allocate 'analysis.prelude' buffer\n");
rz_list_free(list);
return -1;
}
keyword_length = rz_hex_str2bin(prelude, keyword);
} else {
arch_preludes = rz_analysis_preludes(core->analysis);
if (!arch_preludes) {
rz_list_free(list);
return -1;
}
}
@ -571,7 +573,7 @@ static bool maskMatches(int perm, int mask, bool only) {
return false;
}
RZ_API RzList *rz_core_get_boundaries_prot(RzCore *core, int perm, const char *mode, const char *prefix) {
RZ_API RZ_OWN RzList *rz_core_get_boundaries_prot(RzCore *core, int perm, const char *mode, const char *prefix) {
rz_return_val_if_fail(core, NULL);
RzList *list = rz_list_newf(free); // XXX rz_io_map_free);

1
librz/core/cmd/cmd_write.c
View file

@ -517,6 +517,7 @@ RZ_IPI RzCmdStatus rz_write_block_handler(RzCore *core, int argc, const char **a
int len = rz_hex_str2bin(argv[1], hex);
if (len <= 0) {
free(hex);
RZ_LOG_ERROR("Cannot convert '%s' to hex data.\n", argv[1]);
return RZ_CMD_STATUS_ERROR;
}

4
librz/core/tui/panels.c
View file

@ -5431,7 +5431,9 @@ RZ_API bool rz_load_panels_layout(RzCore *core, const char *_name) {
free(panels_config);
return false;
}
__set_read_only(core, p, rz_strbuf_drain(rsb));
char *helptxt = rz_strbuf_drain(rsb);
__set_read_only(core, p, helptxt);
free(helptxt);
}
}
rz_json_free(json);

3
librz/crypto/p/crypto_base91.c
View file

@ -37,6 +37,9 @@ static bool update(RzCrypto *cry, const ut8 *buf, int len) {
olen = rz_base91_encode((char *)obuf, (const ut8 *)buf, len);
} else if (cry->dir == 1) {
olen = rz_base91_decode(obuf, (const char *)buf, len);
} else {
free(obuf);
return false;
}
rz_crypto_append(cry, obuf, olen);
free(obuf);

7
librz/flag/tags.c
View file

@ -3,14 +3,13 @@
#include <rz_flag.h>
RZ_API RzList *rz_flag_tags_set(RzFlag *f, const char *name, const char *words) {
rz_return_val_if_fail(f && name && words, NULL);
RZ_API void rz_flag_tags_set(RzFlag *f, const char *name, const char *words) {
rz_return_if_fail(f && name && words);
const char *k = sdb_fmt("tag.%s", name);
sdb_set(f->tags, k, words, -1);
return NULL;
}
RZ_API RzList *rz_flag_tags_list(RzFlag *f) {
RZ_API RZ_OWN RzList *rz_flag_tags_list(RzFlag *f) {
rz_return_val_if_fail(f, NULL);
RzList *res = rz_list_newf(free);
SdbList *o = sdb_foreach_list(f->tags, false);

4
librz/include/rz_analysis.h
View file

@ -1781,10 +1781,10 @@ RZ_API bool rz_analysis_xrefs_init(RzAnalysis *analysis);
#define RZ_ANALYSIS_THRESHOLDBB 0.7F
/* diff.c */
RZ_API RzAnalysisDiff *rz_analysis_diff_new(void);
RZ_API RZ_OWN RzAnalysisDiff *rz_analysis_diff_new(void);
RZ_API void rz_analysis_diff_setup(RzAnalysis *analysis, int doops, double thbb, double thfcn);
RZ_API void rz_analysis_diff_setup_i(RzAnalysis *analysis, int doops, int thbb, int thfcn);
RZ_API void *rz_analysis_diff_free(RzAnalysisDiff *diff);
RZ_API void rz_analysis_diff_free(RzAnalysisDiff *diff);
RZ_API int rz_analysis_diff_fingerprint_bb(RzAnalysis *analysis, RzAnalysisBlock *bb);
RZ_API size_t rz_analysis_diff_fingerprint_fcn(RzAnalysis *analysis, RzAnalysisFunction *fcn);
RZ_API bool rz_analysis_diff_bb(RzAnalysis *analysis, RzAnalysisFunction *fcn, RzAnalysisFunction *fcn2);

2
librz/include/rz_core.h
View file

@ -1001,7 +1001,7 @@ RZ_API int rz_core_visual_prompt(RzCore *core);
RZ_API bool rz_core_visual_esil(RzCore *core);
RZ_API int rz_core_search_preludes(RzCore *core, bool log);
RZ_API int rz_core_search_prelude(RzCore *core, ut64 from, ut64 to, const ut8 *buf, int blen, const ut8 *mask, int mlen);
RZ_API RzList * /*<RzIOMap*>*/ rz_core_get_boundaries_prot(RzCore *core, int protection, const char *mode, const char *prefix);
RZ_API RZ_OWN RzList * /*<RzIOMap*>*/ rz_core_get_boundaries_prot(RzCore *core, int protection, const char *mode, const char *prefix);
RZ_API void rz_core_hack_help(const RzCore *core);
RZ_API bool rz_core_hack(RzCore *core, const char *op);

4
librz/include/rz_flag.h
View file

@ -176,8 +176,8 @@ static inline bool rz_flag_space_is_empty(RzFlag *f) {
#define rz_flag_space_foreach(f, it, s) rz_spaces_foreach(&(f)->spaces, (it), (s))
/* tags */
RZ_API RzList *rz_flag_tags_list(RzFlag *f);
RZ_API RzList *rz_flag_tags_set(RzFlag *f, const char *name, const char *words);
RZ_API RZ_OWN RzList *rz_flag_tags_list(RzFlag *f);
RZ_API void rz_flag_tags_set(RzFlag *f, const char *name, const char *words);
RZ_API void rz_flag_tags_reset(RzFlag *f, const char *name);
RZ_API RzList *rz_flag_tags_get(RzFlag *f, const char *name);

6
librz/reg/rvalue.c
View file

@ -186,6 +186,7 @@ RZ_API ut64 rz_reg_get_value_by_role(RzReg *reg, RzRegisterId role) {
RZ_API bool rz_reg_set_value(RzReg *reg, RzRegItem *item, ut64 value) {
ut8 bytes[12];
ut8 *src = bytes;
bool unset_src = false;
rz_return_val_if_fail(reg && item, false);
if (rz_reg_is_readonly(reg, item)) {
@ -202,6 +203,7 @@ RZ_API bool rz_reg_set_value(RzReg *reg, RzRegItem *item, ut64 value) {
case 80:
case 96: // long floating value
rz_reg_set_longdouble(reg, item, (long double)value);
unset_src = true;
break;
case 64:
if (reg->big_endian) {
@ -250,11 +252,11 @@ RZ_API bool rz_reg_set_value(RzReg *reg, RzRegItem *item, ut64 value) {
// XXX 128 & 256 bit
return false; // (ut64)rz_reg_get_longdouble (reg, item);
default:
eprintf("rz_reg_set_value: Bit size %d not supported\n", item->size);
RZ_LOG_ERROR("rz_reg_set_value: Bit size %d not supported\n", item->size);
return false;
}
const bool fits_in_arena = (arena->size - BITS2BYTES(item->offset) - BITS2BYTES(item->size)) >= 0;
if (src && fits_in_arena) {
if (!unset_src && fits_in_arena) {
rz_mem_copybits(reg->regset[item->arena].arena->bytes +
BITS2BYTES(item->offset),
src, item->size);

1
librz/signature/pat.c
View file

@ -377,6 +377,7 @@ RZ_API RZ_OWN RzFlirtNode *rz_sign_flirt_parse_string_pattern_from_buffer(RZ_NON
root->child_list = rz_list_newf((RzListFree)rz_sign_flirt_node_free);
if (!root->child_list) {
free(root);
RZ_LOG_ERROR("FLIRT: cannot allocate root node child list\n");
return NULL;
}

5
librz/type/parser/types_parser.c
View file

@ -469,6 +469,7 @@ int parse_struct_node(CParserState *state, TSNode node, const char *text, Parser
result = -1;
goto srnexit;
}
free(real_identifier);
real_identifier = ts_node_sub_string(field_declarator, text);
if (!real_identifier) {
parser_error(state, "ERROR: Struct bitfield identifier should not be NULL!\n");
@ -1906,7 +1907,9 @@ int parse_type_nodes_save(CParserState *state, TSNode node, const char *text) {
}
if (result) {
parser_error(state, "Unsupported type definition: %s\n", ts_node_sub_string(node, text));
char *typetext = ts_node_sub_string(node, text);
parser_error(state, "Unsupported type definition: %s\n", typetext);
free(typetext);
}
// In case of anonymous type we could use identifier as a name for this type?