From 97f09918ef370c3be5aa64dcfeb3bb21e762f90d Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Tue, 14 Mar 2017 20:23:07 -0400
Subject: [PATCH 4/5] Issue 49169 - Fix covscan errors
src/libsds/bpt/map.c - resource leak
ldap/servers/slapd/vattr.c - resource leak
ldap/servers/slapd/task.c: resource leaks
ldap/servers/slapd/str2filter.c - resource leak
ldap/servers/slapd/pw.c - resource leak
ldap/servers/slapd/back-ldbm/import-threads.c - resource leak
ldap/servers/plugins/uiduniq/uid.c:536 - resource leak
ldap/servers/plugins/pwdstorage/pbkdf2_pwd.c:164 - resource leak
ldap/servers/plugins/linkedattrs/linked_attrs.c:1672 - resource leak
ldap/servers/plugins/addn/addn.c:419
ldap/servers/slapd/ssl.c - dead code
ldap/servers/slapd/index_subsystem.c - null dereference
https://pagure.io/389-ds-base/issue/49169
Reviewed by: nkinder & wibrown(Thanks!!)
(cherry picked from commit c75126be1edece121826e336141f9b0b9c0bddfd)
---
ldap/servers/plugins/addn/addn.c | 4 +++-
ldap/servers/plugins/linkedattrs/linked_attrs.c | 2 ++
ldap/servers/plugins/pwdstorage/pbkdf2_pwd.c | 1 +
ldap/servers/plugins/uiduniq/uid.c | 6 +++++-
ldap/servers/slapd/back-ldbm/import-threads.c | 1 +
ldap/servers/slapd/index_subsystem.c | 27 +++++++++++++------------
ldap/servers/slapd/pw.c | 1 +
ldap/servers/slapd/pw_verify.c | 1 -
ldap/servers/slapd/ssl.c | 8 +++-----
ldap/servers/slapd/str2filter.c | 1 +
ldap/servers/slapd/task.c | 3 +--
ldap/servers/slapd/vattr.c | 6 +++---
src/libsds/sds/bpt/map.c | 1 +
13 files changed, 36 insertions(+), 26 deletions(-)
diff --git a/ldap/servers/plugins/addn/addn.c b/ldap/servers/plugins/addn/addn.c
index 3abc112..6ba7833 100644
--- a/ldap/servers/plugins/addn/addn.c
+++ b/ldap/servers/plugins/addn/addn.c
@@ -415,7 +415,9 @@ addn_start(Slapi_PBlock *pb)
domain = slapi_entry_attr_get_charptr(plugin_entry, "addn_default_domain");
if (domain == NULL) {
- slapi_log_err(SLAPI_LOG_ERR, plugin_name, "addn_start: CRITICAL: No default domain in configuration, you must set addn_default_domain!\n");
+ slapi_log_err(SLAPI_LOG_ERR, plugin_name,
+ "addn_start: CRITICAL: No default domain in configuration, you must set addn_default_domain!\n");
+ slapi_ch_free((void**)&config);
return SLAPI_PLUGIN_FAILURE;
}
diff --git a/ldap/servers/plugins/linkedattrs/linked_attrs.c b/ldap/servers/plugins/linkedattrs/linked_attrs.c
index b5adb21..d046542 100644
--- a/ldap/servers/plugins/linkedattrs/linked_attrs.c
+++ b/ldap/servers/plugins/linkedattrs/linked_attrs.c
@@ -1669,6 +1669,8 @@ linked_attrs_mod_post_op(Slapi_PBlock *pb)
/* Bail out if the plug-in close function was just called. */
if (!slapi_plugin_running(pb)) {
linked_attrs_unlock();
+ slapi_mod_free(&next_mod);
+ slapi_mods_free(&smods);
return SLAPI_PLUGIN_SUCCESS;
}
diff --git a/ldap/servers/plugins/pwdstorage/pbkdf2_pwd.c b/ldap/servers/plugins/pwdstorage/pbkdf2_pwd.c
index 1b3e555..b228700 100644
--- a/ldap/servers/plugins/pwdstorage/pbkdf2_pwd.c
+++ b/ldap/servers/plugins/pwdstorage/pbkdf2_pwd.c
@@ -161,6 +161,7 @@ pbkdf2_sha256_pw_enc(const char *pwd)
*/
if ( pbkdf2_sha256_hash(hash + PBKDF2_ITERATIONS_LENGTH + PBKDF2_SALT_LENGTH, PBKDF2_HASH_LENGTH, &passItem, &saltItem, PBKDF2_ITERATIONS) != SECSuccess ) {
slapi_log_err(SLAPI_LOG_ERR, (char *)schemeName, "Could not generate pbkdf2_sha256_hash!\n");
+ slapi_ch_free_string(&enc);
return NULL;
}
diff --git a/ldap/servers/plugins/uiduniq/uid.c b/ldap/servers/plugins/uiduniq/uid.c
index ae9320e..46554b2 100644
--- a/ldap/servers/plugins/uiduniq/uid.c
+++ b/ldap/servers/plugins/uiduniq/uid.c
@@ -533,7 +533,11 @@ create_filter(const char **attributes, const struct berval *value, const char *r
/* Place value in filter */
if (ldap_quote_filter_value(value->bv_val, value->bv_len,
- fp, max-fp, &valueLen)) { slapi_ch_free((void**)&filter); return 0; }
+ fp, max-fp, &valueLen)) {
+ slapi_ch_free((void**)&filter);
+ slapi_ch_free((void**)&attrLen);
+ return 0;
+ }
fp += valueLen;
strcpy(fp, ")");
diff --git a/ldap/servers/slapd/back-ldbm/import-threads.c b/ldap/servers/slapd/back-ldbm/import-threads.c
index 5b81427..087103b 100644
--- a/ldap/servers/slapd/back-ldbm/import-threads.c
+++ b/ldap/servers/slapd/back-ldbm/import-threads.c
@@ -1647,6 +1647,7 @@ upgradedn_producer(void *param)
}
e = slapi_str2entry_ext(normdn, NULL, data.dptr,
SLAPI_STR2ENTRY_USE_OBSOLETE_DNFORMAT);
+ slapi_ch_free_string(&rdn);
}
} else {
e =
diff --git a/ldap/servers/slapd/index_subsystem.c b/ldap/servers/slapd/index_subsystem.c
index 57d4f58..8f9fe6d 100644
--- a/ldap/servers/slapd/index_subsystem.c
+++ b/ldap/servers/slapd/index_subsystem.c
@@ -185,27 +185,28 @@ static int index_subsys_index_matches_filter(indexEntry *index, Slapi_Filter *f)
*/
int index_subsys_assign_filter_decoders(Slapi_PBlock *pb)
{
- int rc;
+ int rc = 0;
Slapi_Filter *f;
char *subsystem = "index_subsys_assign_filter_decoders";
char logbuf[ 1024 ];
/* extract the filter */
slapi_pblock_get(pb, SLAPI_SEARCH_FILTER, &f);
+ if (f) {
+ if ( loglevel_is_set( LDAP_DEBUG_FILTER )) {
+ logbuf[0] = '\0';
+ slapi_log_err(SLAPI_LOG_DEBUG, subsystem, "before: %s\n",
+ slapi_filter_to_string(f, logbuf, sizeof(logbuf)));
+ }
- if ( loglevel_is_set( LDAP_DEBUG_FILTER ) && NULL != f ) {
- logbuf[0] = '\0';
- slapi_log_err(SLAPI_LOG_DEBUG, subsystem, "before: %s\n",
- slapi_filter_to_string(f, logbuf, sizeof(logbuf)));
- }
-
- /* find decoders */
- rc = index_subsys_assign_decoders(f);
+ /* find decoders */
+ rc = index_subsys_assign_decoders(f);
- if ( loglevel_is_set( LDAP_DEBUG_FILTER ) && NULL != f ) {
- logbuf[0] = '\0';
- slapi_log_err(SLAPI_LOG_DEBUG, subsystem, " after: %s\n",
- slapi_filter_to_string(f, logbuf, sizeof(logbuf)));
+ if ( loglevel_is_set( LDAP_DEBUG_FILTER )) {
+ logbuf[0] = '\0';
+ slapi_log_err(SLAPI_LOG_DEBUG, subsystem, " after: %s\n",
+ slapi_filter_to_string(f, logbuf, sizeof(logbuf)));
+ }
}
return rc;
diff --git a/ldap/servers/slapd/pw.c b/ldap/servers/slapd/pw.c
index 215c9eb..378d148 100644
--- a/ldap/servers/slapd/pw.c
+++ b/ldap/servers/slapd/pw.c
@@ -1512,6 +1512,7 @@ check_trivial_words (Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Value **vals, char
ep = sp + strlen(sp);
ep = ldap_utf8prevn(sp, ep, toklen);
if (!ep || (sp >= ep)) {
+ slapi_ch_free_string(&sp);
continue;
}
/* See if the password contains the value */
diff --git a/ldap/servers/slapd/pw_verify.c b/ldap/servers/slapd/pw_verify.c
index 529bb83..a9fd9ec 100644
--- a/ldap/servers/slapd/pw_verify.c
+++ b/ldap/servers/slapd/pw_verify.c
@@ -103,7 +103,6 @@ pw_verify_be_dn(Slapi_PBlock *pb, Slapi_Entry **referral)
int
pw_validate_be_dn(Slapi_PBlock *pb, Slapi_Entry **referral)
{
- int rc = 0;
Slapi_Backend *be = NULL;
Slapi_DN *pb_sdn;
struct berval *cred;
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index f35b3f1..050e7b5 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -1418,12 +1418,10 @@ slapd_ssl_init()
errorCode = PR_GetError();
slapd_SSL_error("Failed to retrieve SSL "
"configuration information ("
- SLAPI_COMPONENT_NAME_NSPR " error %d - %s): "
+ SLAPI_COMPONENT_NAME_NSPR " error %d - not found): "
"nssslSessionTimeout: %s ",
- errorCode, slapd_pr_strerror(errorCode),
- (val ? "found" : "not found"));
- slapi_ch_free((void **) &val);
- slapi_ch_free((void **) &ciphers);
+ errorCode, slapd_pr_strerror(errorCode));
+ slapi_ch_free((void **)&ciphers);
freeConfigEntry( &entry );
return -1;
}
diff --git a/ldap/servers/slapd/str2filter.c b/ldap/servers/slapd/str2filter.c
index ebd5c5d..744c93f 100644
--- a/ldap/servers/slapd/str2filter.c
+++ b/ldap/servers/slapd/str2filter.c
@@ -344,6 +344,7 @@ str2simple( char *str , int unescape_filter)
*endp = '\0';
rc = _parse_ext_filter(str, extp, &f->f_mr_type, &f->f_mr_oid, &f->f_mr_dnAttrs);
if (rc) {
+ slapi_filter_free(f, 1);
return NULL; /* error */
} else {
f->f_choice = LDAP_FILTER_EXTENDED;
diff --git a/ldap/servers/slapd/task.c b/ldap/servers/slapd/task.c
index ad52e9d..eabd517 100644
--- a/ldap/servers/slapd/task.c
+++ b/ldap/servers/slapd/task.c
@@ -2389,7 +2389,6 @@ task_fixup_tombstones_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter,
slapi_task_finish(task, *returncode);
slapi_ch_array_free(base);
slapi_ch_free((void **)&task_data);
- return SLAPI_DSE_CALLBACK_ERROR;
}
done:
@@ -2507,9 +2506,9 @@ task_des2aes(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter,
error:
if (rc == SLAPI_DSE_CALLBACK_ERROR){
slapi_ch_array_free(bases);
- slapi_ch_array_free(suffix);
slapi_ch_free((void **)&task_data);
}
+ slapi_ch_array_free(suffix);
return rc;
}
diff --git a/ldap/servers/slapd/vattr.c b/ldap/servers/slapd/vattr.c
index 34665de..599b54e 100644
--- a/ldap/servers/slapd/vattr.c
+++ b/ldap/servers/slapd/vattr.c
@@ -753,10 +753,10 @@ slapi_vattr_values_get_sp(vattr_context *c,
}
if (use_local_ctx) {
/* slapi_pblock_destroy cleans up pb_vattr_context, as well */
- slapi_pblock_destroy(local_pb);
- } else {
- vattr_context_ungrok(&c);
+ slapi_pblock_destroy(local_pb);
+ ctx->pb = NULL;
}
+ vattr_context_ungrok(&ctx);
return rc;
}
diff --git a/src/libsds/sds/bpt/map.c b/src/libsds/sds/bpt/map.c
index 4205aa5..2c3468b 100644
--- a/src/libsds/sds/bpt/map.c
+++ b/src/libsds/sds/bpt/map.c
@@ -18,6 +18,7 @@ sds_bptree_map_nodes(sds_bptree_instance *binst, sds_bptree_node *root, sds_resu
sds_bptree_node_list *tail = cur;
if (binst == NULL) {
+ sds_free(cur);
return SDS_NULL_POINTER;
}
--
2.9.3