From 8ca45d1ea519d7a77dd5795920ef821310dac3c5 Mon Sep 17 00:00:00 2001 From: Peiwei Hu Date: Sun, 21 Dec 2025 13:48:48 +0800 Subject: [PATCH] Fix the missing release of RZ_OWN parameters (#5641) --- librz/arch/asm.c | 1 + librz/arch/isa/arm/arm_il32.c | 1 + librz/arch/isa/sh/sh_il.c | 1 + librz/arch/var.c | 2 -- librz/bin/format/mach0/coresymbolication.c | 2 +- librz/bin/format/mach0/coresymbolication.h | 2 +- librz/bin/p/bin_symbols.c | 4 +++- librz/core/cmd/cmd_search.c | 2 ++ librz/search/bytes_search.c | 4 ++++ librz/type/function.c | 3 +++ librz/type/helpers.c | 1 + librz/type/parser/types_storage.c | 2 ++ librz/type/path.c | 1 + librz/type/serialize_functions.c | 1 - librz/util/vector.c | 4 ++++ 15 files changed, 25 insertions(+), 6 deletions(-) diff --git a/librz/arch/asm.c b/librz/arch/asm.c index bb0ecd09cf..333e85d5d3 100644 --- a/librz/arch/asm.c +++ b/librz/arch/asm.c @@ -1386,6 +1386,7 @@ RZ_API RZ_OWN RzAsmTokenString *rz_asm_token_string_clone(RZ_OWN RZ_NONNULL RzAs RzAsmTokenString *newt = RZ_NEW0(RzAsmTokenString); if (!newt) { + rz_asm_token_string_free(toks); return NULL; } newt->tokens = rz_pvector_clonef(toks->tokens, (RzPVectorItemCpyFunc)clone_asm_token); diff --git a/librz/arch/isa/arm/arm_il32.c b/librz/arch/isa/arm/arm_il32.c index e457e3e949..9821e320a4 100644 --- a/librz/arch/isa/arm/arm_il32.c +++ b/librz/arch/isa/arm/arm_il32.c @@ -462,6 +462,7 @@ static RzILOpBitVector *replicated_val(ut32 val_width, ut32 dreg_width, RZ_OWN R ut32 repeat_times = dreg_width / val_width; if (dreg_width % val_width != 0) { rz_warn_if_reached(); + rz_il_op_pure_free(val); return NULL; } diff --git a/librz/arch/isa/sh/sh_il.c b/librz/arch/isa/sh/sh_il.c index f2b04816ac..dbf8b3866b 100644 --- a/librz/arch/isa/sh/sh_il.c +++ b/librz/arch/isa/sh/sh_il.c @@ -468,6 +468,7 @@ static RzILOpEffect *sh_il_set_param_pc_ctx(SHParam param, RZ_OWN RzILOpPure *va case SH_IMM_S: default: RZ_LOG_ERROR("RzIL: SuperH: Cannot set value for addressing mode: %u\n", param.mode); + rz_il_op_pure_free(val); return NULL; } diff --git a/librz/arch/var.c b/librz/arch/var.c index a68a2bba75..d153642aa3 100644 --- a/librz/arch/var.c +++ b/librz/arch/var.c @@ -1821,8 +1821,6 @@ RZ_API void rz_analysis_fcn_vars_add_types(RzAnalysis *analysis, RZ_NONNULL RzAn RzCallableArg *arg = rz_type_callable_arg_new(analysis->typedb, var->name, cloned); if (arg) { rz_type_callable_arg_add(callable, arg); - } else { - rz_type_free(cloned); } } } diff --git a/librz/bin/format/mach0/coresymbolication.c b/librz/bin/format/mach0/coresymbolication.c index ef80956757..c2da66303b 100644 --- a/librz/bin/format/mach0/coresymbolication.c +++ b/librz/bin/format/mach0/coresymbolication.c @@ -129,7 +129,7 @@ static char *str_ndup_safe(const ut8 *b, const ut8 *str, ut64 len, const ut8 *en return NULL; } -RZ_API RzCoreSymCacheElement *rz_coresym_cache_element_new(RzBinFile *bf, RzBuffer *buf, ut64 off, int bits, RZ_OWN char *file_name) { +RZ_API RzCoreSymCacheElement *rz_coresym_cache_element_new(RzBinFile *bf, RzBuffer *buf, ut64 off, int bits, RZ_BORROW char *file_name) { RzCoreSymCacheElement *result = NULL; ut8 *b = NULL; RzCoreSymCacheElementHdr *hdr = rz_coresym_cache_element_header_new(buf, off, bits); diff --git a/librz/bin/format/mach0/coresymbolication.h b/librz/bin/format/mach0/coresymbolication.h index e4695baf47..766ca7362a 100644 --- a/librz/bin/format/mach0/coresymbolication.h +++ b/librz/bin/format/mach0/coresymbolication.h @@ -81,7 +81,7 @@ typedef struct rz_coresym_cache_element_t { RzCoreSymCacheElementLineInfo *line_info; } RzCoreSymCacheElement; -RZ_API RzCoreSymCacheElement *rz_coresym_cache_element_new(RzBinFile *bf, RzBuffer *buf, ut64 off, int bits, RZ_OWN char *file_name); +RZ_API RzCoreSymCacheElement *rz_coresym_cache_element_new(RzBinFile *bf, RzBuffer *buf, ut64 off, int bits, RZ_BORROW char *file_name); RZ_API void rz_coresym_cache_element_free(RzCoreSymCacheElement *element); RZ_API ut64 rz_coresym_cache_element_pa2va(RzCoreSymCacheElement *element, ut64 pa); diff --git a/librz/bin/p/bin_symbols.c b/librz/bin/p/bin_symbols.c index 846dd3fe7c..b10160bae0 100644 --- a/librz/bin/p/bin_symbols.c +++ b/librz/bin/p/bin_symbols.c @@ -186,7 +186,7 @@ static RzBinSymbol *bin_symbol_from_symbol(RzCoreSymCacheElement *element, RzCor return sym; } -static RzCoreSymCacheElement *parseDragons(RzBinFile *bf, RzBuffer *buf, int off, int bits, RZ_OWN char *file_name) { +static RzCoreSymCacheElement *parseDragons(RzBinFile *bf, RzBuffer *buf, int off, int bits, RZ_BORROW char *file_name) { D eprintf("Dragons at 0x%x\n", off); ut64 size = rz_buf_size(buf); if (off >= size) { @@ -203,6 +203,7 @@ static RzCoreSymCacheElement *parseDragons(RzBinFile *bf, RzBuffer *buf, int off int available = rz_buf_read_at(buf, off, b, size); if (available != size) { RZ_LOG_ERROR("bin: symbols: cannot read at 0x%08x\n", off); + free(b); return NULL; } // after the list of sections, there's a bunch of unknown @@ -239,6 +240,7 @@ static RzCoreSymCacheElement *parseDragons(RzBinFile *bf, RzBuffer *buf, int off available = rz_buf_read_at(buf, off - 8, b, size); if (available != size) { RZ_LOG_WARN("bin: symbols: rz_buf_read_at failed\n"); + free(b); return NULL; } if (size > 3 && !memcmp("\x1a\x2b\xb2\xa1", b, 4)) { // 0x130 ? diff --git a/librz/core/cmd/cmd_search.c b/librz/core/cmd/cmd_search.c index 022289a537..7ebf266732 100644 --- a/librz/core/cmd/cmd_search.c +++ b/librz/core/cmd/cmd_search.c @@ -1943,6 +1943,7 @@ static RzCmdStatus byte_pattern_search(RzCore *core, RZ_OWN RzSearchBytesPattern return cmd_core_handle_search_hits(core, state, hits); error: + rz_search_bytes_pattern_free(pattern); rz_list_free(hits); rz_search_opt_free(search_opts); CMD_SEARCH_END(); @@ -1974,6 +1975,7 @@ static RzCmdStatus value_range_search(RzCore *core, RZ_OWN RzVector /*bytes = bytes; @@ -303,11 +305,13 @@ RZ_API bool rz_search_collection_bytes_add_pattern(RZ_NONNULL RzSearchCollection if (!rz_search_collection_has_find_callback(col, bytes_find)) { RZ_LOG_ERROR("search: cannot add hex to non-bytes collection\n"); + rz_search_bytes_pattern_free(bytes_pattern); return false; } if (!rz_pvector_push((RzPVector *)col->user, bytes_pattern)) { RZ_LOG_ERROR("search: cannot add byte pattern to search.\n"); + rz_search_bytes_pattern_free(bytes_pattern); return false; } return true; diff --git a/librz/type/function.c b/librz/type/function.c index b6faf9aa8b..83fc1e21e4 100644 --- a/librz/type/function.c +++ b/librz/type/function.c @@ -70,6 +70,7 @@ RZ_API RZ_OWN RzCallableArg *rz_type_callable_arg_new(RzTypeDB *typedb, RZ_NONNU rz_return_val_if_fail(typedb && name && type, NULL); RzCallableArg *arg = RZ_NEW0(RzCallableArg); if (!arg) { + rz_type_free(type); return NULL; } arg->name = rz_str_dup(name); @@ -132,6 +133,7 @@ RZ_API RZ_OWN RzCallable *rz_type_func_new(RzTypeDB *typedb, RZ_NONNULL const ch rz_return_val_if_fail(typedb && name, NULL); RzCallable *callable = rz_type_callable_new(name); if (!callable) { + rz_type_free(type); return NULL; } callable->ret = type; @@ -339,6 +341,7 @@ RZ_API bool rz_type_func_arg_add(RzTypeDB *typedb, RZ_NONNULL const char *func_n rz_return_val_if_fail(typedb && func_name, false); RzCallable *callable = rz_type_func_get(typedb, func_name); if (!callable) { + rz_type_free(arg_type); return false; } RzCallableArg *arg = rz_type_callable_arg_new(typedb, arg_name, arg_type); diff --git a/librz/type/helpers.c b/librz/type/helpers.c index 62ef65c509..71a2428963 100644 --- a/librz/type/helpers.c +++ b/librz/type/helpers.c @@ -177,6 +177,7 @@ RZ_API RZ_OWN RzType *rz_type_callable(RZ_NONNULL RZ_OWN RzCallable *callable) { rz_return_val_if_fail(callable, NULL); RzType *newtype = RZ_NEW0(RzType); if (!newtype) { + rz_type_callable_free(callable); return NULL; } newtype->kind = RZ_TYPE_KIND_CALLABLE; diff --git a/librz/type/parser/types_storage.c b/librz/type/parser/types_storage.c index 0093766340..be97b3dc67 100644 --- a/librz/type/parser/types_storage.c +++ b/librz/type/parser/types_storage.c @@ -838,12 +838,14 @@ bool c_parser_new_callable_argument(CParserState *state, RZ_NONNULL RzCallable * rz_pvector_foreach (callable->args, it) { RzCallableArg *arg = *it; if (!strcmp(arg->name, name)) { + rz_type_free(type); return false; } } // And only if there is no argument with the same name - proceed to insert it RzCallableArg *arg = RZ_NEW0(RzCallableArg); if (!arg) { + rz_type_free(type); return false; } arg->name = rz_str_dup(name); diff --git a/librz/type/path.c b/librz/type/path.c index 572ad9f023..209abc18cf 100644 --- a/librz/type/path.c +++ b/librz/type/path.c @@ -14,6 +14,7 @@ RZ_API RZ_OWN RzTypePath *rz_type_path_new(RZ_BORROW RZ_NONNULL RzType *type, RZ rz_return_val_if_fail(type && path, NULL); RzTypePath *tpath = RZ_NEW0(RzTypePath); if (!tpath) { + RZ_FREE(path); return NULL; } tpath->typ = type; diff --git a/librz/type/serialize_functions.c b/librz/type/serialize_functions.c index 9e4b82d56f..3a9534d2bc 100644 --- a/librz/type/serialize_functions.c +++ b/librz/type/serialize_functions.c @@ -84,7 +84,6 @@ static RzCallable *get_callable_type(RzTypeDB *typedb, Sdb *sdb, const char *nam RzCallableArg *arg = rz_type_callable_arg_new(typedb, argument_name, ttype); if (!arg) { free(values); - rz_type_free(ttype); goto error; } free(values); diff --git a/librz/util/vector.c b/librz/util/vector.c index e9de61490e..cb9e8a1bad 100644 --- a/librz/util/vector.c +++ b/librz/util/vector.c @@ -499,6 +499,10 @@ RZ_API void *rz_pvector_assign_at(RZ_BORROW RZ_NONNULL RzPVector *vec, size_t in rz_return_val_if_fail(vec && ptr, NULL); void **p = rz_vector_index_ptr(&vec->v, index); if (!p) { + if (vec->v.free_user) { + RzPVectorFree free_fn = (RzPVectorFree)vec->v.free_user; + free_fn(ptr); + } return NULL; } void *prev = *p;