#519 Use of uninitialized values in col_allocate_item()
Closed: Fixed Opened by sgallagh.

From Coverity:

  206/* A generic function to allocate a property item */
  207int col_allocate_item(struct collection_item **ci, const char *property,
  208                      const void *item_data, int length, int type)
  209{
Declaring variable "item".
  210    struct collection_item *item = NULL;
...
  226    /* Allocate memory for the structure */
Assigning: "item" = "(struct collection_item*)malloc(48UL)", which is allocated but not initialized.
  227    item = (struct collection_item *)malloc(sizeof(struct collection_item));
At conditional (3): "item == NULL" taking the false branch.
  228    if (item == NULL)  {
  229        TRACE_ERROR_STRING("col_allocate_item", "Malloc failed.");
  230        return ENOMEM;
  231    }
  232
  233    /* After we initialize "next" we can use delete_item() in case of error */
  234    item->next = NULL;
  235
  236    /* Copy property */
At conditional (4): "0" taking the false branch.
  237    item->property = strdup(property);
At conditional (5): "item->property == NULL" taking the true branch.
  238    if (item->property == NULL) {
  239        TRACE_ERROR_STRING("col_allocate_item", "Failed to dup property.");
Using uninitialized value "item->data" when calling "col_delete_item". [show details]
Using uninitialized value "item->type" when calling "col_delete_item". [show details]
  240        col_delete_item(item);
  241        return ENOMEM;
  242    }

This is definitely a bug. Calling col_delete_item() on a partially-initialized item will perform comparisons on uninitialized values.


Also appears in collection_ut.c in iterator_test()

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.2.1

Fields changed

keywords: => coverity

Fixed by 19e3e0bb949ccf10bc6e83cd81cbca294a99e747

fixedin: => 1.2.1
resolution: => fixed
status: new => closed

Fields changed

rhbz: => 0

Metadata Update from @sgallagh:
- Issue assigned to dpal
- Issue set to the milestone: SSSD 1.2.1

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1561

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata