ipa_kdb_mkey.c

Bug Summary

File:	daemons/ipa-kdb/ipa_kdb_mkey.c
Warning:	line 91, column 20 Potential leak of memory pointed to by 'k.contents'

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ipa_kdb_mkey.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -mthread-model posix -mframe-pointer=all -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/10.0.0 -D HAVE_CONFIG_H -I . -I ../.. -I . -I ../../util -D PREFIX="/usr/local" -D BINDIR="/usr/local/bin" -D LIBDIR="/usr/local/lib" -D LIBEXECDIR="/usr/local/libexec" -D DATADIR="/usr/local/share" -D LDAPIDIR="/run" -I /usr/include/samba-4.0 -D _GNU_SOURCE=1 -D HAVE_IMMEDIATE_STRUCTURES=1 -I /usr/include/nss3 -I /usr/include/nspr4 -I /usr/include/nspr4 -I /usr/include/nss3 -I /usr/include/nspr4 -D __STDC_WANT_LIB_EXT1__=1 -D _DEFAULT_SOURCE=1 -D _POSIX_C_SOURCE=200809L -D PIC -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/10.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir /home/heimes/redhat/freeipa/daemons/ipa-kdb -ferror-limit 19 -fmessage-length 0 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-output=html -faddrsig -o /home/heimes/redhat/freeipa/report/2020-06-05-101548-295465-1 -x c ipa_kdb_mkey.c

1/*
* MIT Kerberos KDC database backend for FreeIPA
*
* Authors: Simo Sorce <ssorce@redhat.com>
*
* Copyright (C) 2011  Simo Sorce, Red Hat
* see file 'COPYING' for use and warranty information
*
* This program is free software you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

23#include "ipa_kdb.h"

25static char *krbmkey_attrs[] = {
  "krbMKey",
  NULL((void*)0)
28};

30krb5_error_code ipadb_fetch_master_key(krb5_context kcontext,
                                     krb5_principal mname,
                                     krb5_keyblock *key,
                                     krb5_kvno *kvno,
                                     char *db_args)
35{
  struct ipadb_context *ipactx;
  LDAPMessage *res = NULL((void*)0);
  LDAPMessage *first;
  struct berval **vals = NULL((void*)0);
  BerElement *be = NULL((void*)0);
  krb5_error_code kerr;
  krb5_keyblock k;
  int mkvno;
  int ret;
  int i;

  ipactx = ipadb_get_context(kcontext);
  if (!ipactx) {
1
Assuming 'ipactx' is non-null→
2
←
Taking false branch→
      return KRB5_KDB_DBNOTINITED(-1780008435L);
  }

  if (!ipactx->lcontext) {
3
←
Assuming field 'lcontext' is non-null→
4
←
Taking false branch→
      ret = ipadb_get_connection(ipactx);
      if (ret != 0) {
          kerr = KRB5_KDB_SERVER_INTERNAL_ERR(-1780008413L);
          goto done;
      }
  }

  be = ber_alloc_t(LBER_USE_DER0x01);
  if (!be) {
5
←
Assuming 'be' is non-null→
6
←
Taking false branch→
      kerr = ENOMEM12;
      goto done;
  }

  kerr = ipadb_simple_search(ipactx, ipactx->realm_base, LDAP_SCOPE_BASE((ber_int_t) 0x0000),
                             "(krbMKey=*)", krbmkey_attrs, &res);
  if (kerr) {
7
←
Assuming 'kerr' is 0→
8
←
Taking false branch→
      goto done;
  }

  first = ldap_first_entry(ipactx->lcontext, res);
  if (!first) {
9
←
Assuming 'first' is non-null→
10
←
Taking false branch→
      kerr = KRB5_KDB_NOENTRY(-1780008443L);
      goto done;
  }

  mkvno = 0;
  k.contents = NULL((void*)0);
  vals = ldap_get_values_len(ipactx->lcontext, first, "krbmkey");
  for (i = 0; vals[i]; i++) {
11
←
Loop condition is true.  Entering loop body→
20
←
Loop condition is true.  Entering loop body→
      struct berval *mkey;
      ber_tag_t tag;
      ber_int_t tvno;
      ber_int_t ttype;

      ber_init2(be, vals[i], LBER_USE_DER0x01);

      tag = ber_scanf(be, "{i{iO}}", &tvno, &ttype, &mkey);
      if (tag == LBER_ERROR((ber_tag_t) -1)) {
12
←
Assuming the condition is false→
13
←
Taking false branch→
21
←
Assuming the condition is true→
22
←
Taking true branch→
          kerr = KRB5_KDB_SERVER_INTERNAL_ERR(-1780008413L);
23
←
Potential leak of memory pointed to by 'k.contents'
          goto done;
      }

      if (tvno > mkvno) {
14
←
Assuming 'tvno' is > 'mkvno'→
15
←
Taking true branch→
          mkvno = tvno;
          k.enctype = ttype;
          k.length = mkey->bv_len;
          if (k.contents15.1
Field 'contents' is null
) {
16
←
Taking false branch→
              free(k.contents);
          }
          k.contents = malloc(k.length);
17
←
Memory is allocated→
          if (!k.contents) {
18
←
Assuming field 'contents' is non-null→
19
←
Taking false branch→
              kerr = ENOMEM12;
              goto done;
          }
          memcpy(k.contents, mkey->bv_val, k.length);
      }
      ber_bvfree(mkey);
  }

  if (mkvno == 0) {
      kerr = KRB5_KDB_NOENTRY(-1780008443L);
      goto done;
  }

  *kvno = mkvno;
  key->magic = KV5M_KEYBLOCK(-1760647421L);
  key->enctype = k.enctype;
  key->length = k.length;
  key->contents = k.contents;

  kerr = 0;

125done:
  if (be) {
      ber_free(be, 0);
  }
  ldap_value_free_len(vals);
  ldap_msgfree(res);
  return kerr;
132}

134krb5_error_code ipadb_store_master_key_list(krb5_context kcontext,
                                          char *db_arg,
                                          krb5_principal mname,
                                          krb5_keylist_node *keylist,
                                          char *master_pwd)
139{
  struct ipadb_context *ipactx;
  BerElement *be = NULL((void*)0);
  krb5_keyblock k = { 0, 0, 0, NULL((void*)0) };
  struct berval mkey;
  ber_int_t tvno;
  ber_int_t ttype;
  LDAPMod **mods = NULL((void*)0);
  krb5_error_code kerr;
  int ret;

  ipactx = ipadb_get_context(kcontext);
  if (!ipactx) {
      return KRB5_KDB_DBNOTINITED(-1780008435L);
  }

  /* we support storing only one key for now */
  if (!keylist || keylist->next) {
      return EINVAL22;
  }

  if (!ipactx->lcontext) {
      ret = ipadb_get_connection(ipactx);
      if (ret != 0) {
          kerr = KRB5_KDB_SERVER_INTERNAL_ERR(-1780008413L);
          goto done;
      }
  }

  be = ber_alloc_t(LBER_USE_DER0x01);
  if (!be) {
      kerr = ENOMEM12;
      goto done;
  }


  tvno = keylist->kvno;
  ttype = keylist->keyblock.enctype;
  mkey.bv_len = keylist->keyblock.length;
  mkey.bv_val = (void *)keylist->keyblock.contents;

  ret = ber_printf(be, "{i{iO}}", tvno, ttype, &mkey);
  if (ret == -1) {
      kerr = KRB5_KDB_INTERNAL_ERROR(-1780008411L);
      goto done;
  }

  mods = calloc(2, sizeof(LDAPMod *));
  if (!mods) {
      kerr = ENOMEM12;
      goto done;
  }
  mods[0] = calloc(1, sizeof(LDAPMod));
  if (!mods[0]) {
      kerr = ENOMEM12;
      goto done;
  }
  mods[0]->mod_op = LDAP_MOD_ADD(0x0000) | LDAP_MOD_BVALUES(0x0080);
  mods[0]->mod_type = strdup("krbMKey");
  if (!mods[0]->mod_type) {
      kerr = ENOMEM12;
      goto done;
  }
  mods[0]->mod_bvaluesmod_vals.modv_bvals = calloc(2, sizeof(struct berval *));
  if (!mods[0]->mod_bvaluesmod_vals.modv_bvals) {
      kerr = ENOMEM12;
      goto done;
  }

  ret = ber_flatten(be, &mods[0]->mod_bvaluesmod_vals.modv_bvals[0]);
  if (ret == -1) {
      kerr = KRB5_KDB_INTERNAL_ERROR(-1780008411L);
      goto done;
  }

  kerr = ipadb_simple_modify(ipactx, ipactx->realm_base, mods);

  kerr = 0;

218done:
  if (be) {
      ber_free(be, 1);
  }
  krb5_free_keyblock_contents(kcontext, &k);
  ldap_mods_free(mods, 1);
  return kerr;
225}