From Coverity:
206/* A generic function to allocate a property item */ 207int col_allocate_item(struct collection_item **ci, const char *property, 208 const void *item_data, int length, int type) 209{ Declaring variable "item". 210 struct collection_item *item = NULL; ... 226 /* Allocate memory for the structure */ Assigning: "item" = "(struct collection_item*)malloc(48UL)", which is allocated but not initialized. 227 item = (struct collection_item *)malloc(sizeof(struct collection_item)); At conditional (3): "item == NULL" taking the false branch. 228 if (item == NULL) { 229 TRACE_ERROR_STRING("col_allocate_item", "Malloc failed."); 230 return ENOMEM; 231 } 232 233 /* After we initialize "next" we can use delete_item() in case of error */ 234 item->next = NULL; 235 236 /* Copy property */ At conditional (4): "0" taking the false branch. 237 item->property = strdup(property); At conditional (5): "item->property == NULL" taking the true branch. 238 if (item->property == NULL) { 239 TRACE_ERROR_STRING("col_allocate_item", "Failed to dup property."); Using uninitialized value "item->data" when calling "col_delete_item". [show details] Using uninitialized value "item->type" when calling "col_delete_item". [show details] 240 col_delete_item(item); 241 return ENOMEM; 242 }
This is definitely a bug. Calling col_delete_item() on a partially-initialized item will perform comparisons on uninitialized values.
Also appears in collection_ut.c in iterator_test()
Fields changed
milestone: NEEDS_TRIAGE => SSSD 1.2.1
keywords: => coverity
Fixed by 19e3e0bb949ccf10bc6e83cd81cbca294a99e747
fixedin: => 1.2.1 resolution: => fixed status: new => closed
rhbz: => 0
Metadata Update from @sgallagh: - Issue assigned to dpal - Issue set to the milestone: SSSD 1.2.1
SSSD is moving from Pagure to Github. This means that new issues and pull requests will be accepted only in SSSD's github repository.
This issue has been cloned to Github and is available here: - https://github.com/SSSD/sssd/issues/1561
If you want to receive further updates on the issue, please navigate to the github issue and click on subscribe button.
subscribe
Thank you for understanding. We apologize for all inconvenience.