Issue 8487 - Properly handle realloc() failures
Summary: Properly handle realloc() failures
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: unspecified
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-29 23:15 UTC by cissp@bryongloden.com
Modified: 2017-03-17 20:34 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description cissp@bryongloden.com 2016-08-29 23:15:15 UTC
Full_Name: Bryon Gloden, CISSP.
Version: 
OS: 
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (161.133.194.55)


Greetings. On line numbers 123 and 134 of liblmdb/midl.c
(https://github.com/LMDB/lmdb/blob/mdb.master/libraries/liblmdb/midl.c) there
are two common realloc() mistakes. Passing one pointer into realloc() and
assigning the result directly into that same pointer variable can cause a memory
leak if the reallocation fails, because the original allocation will still
exist. The correct way to do this is to use a temporary pointer variable.

Credit: http://stackoverflow.com/a/11548901

Found by https://github.com/bryongloden/cppcheck 
Comment 1 Howard Chu 2016-08-30 00:58:13 UTC
cissp@bryongloden.com wrote:
> Full_Name: Bryon Gloden, CISSP.
> Version:
> OS:
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (161.133.194.55)
>
>
> Greetings. On line numbers 123 and 134 of liblmdb/midl.c
> (https://github.com/LMDB/lmdb/blob/mdb.master/libraries/liblmdb/midl.c) there
> are two common realloc() mistakes. Passing one pointer into realloc() and
> assigning the result directly into that same pointer variable can cause a memory
> leak if the reallocation fails, because the original allocation will still
> exist. The correct way to do this is to use a temporary pointer variable.
>
> Credit: http://stackoverflow.com/a/11548901
>
> Found by https://github.com/bryongloden/cppcheck
>
>
This is all false.

On line number 123 we are shrinking the memory region - this will never fail. 
At worst it can only return the original pointer unchanged.

On line number 134 we are leaving the original pointer unchanged on failure, 
it is not leaked. The caller can free it if it wants to.

Closing this ITS.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

Comment 2 OpenLDAP project 2017-03-17 20:34:02 UTC
invalid
Comment 3 Quanah Gibson-Mount 2017-03-17 20:34:02 UTC
changed notes
changed state Open to Closed