static analysis reports "Resource leak" issues in stx-fault/fm_common

Bug #1794705 reported by Ran An
272
This bug affects 1 person
Affects Status Importance Assigned to Milestone
StarlingX
Fix Released
High
Ran An

Bug Description

Brief Description
-----------------
  there is a memory leak in function 'fm_db_util_get_timestamp' fmDbUtils.cpp

Severity
--------
 Major

Steps to Reproduce
------------------
  free memory before function return

Expected Behavior
------------------
  static analysis do not report this issue

Actual Behavior
----------------
  static analysis report this issue

Reproducibility
---------------
Reproducible

System Configuration
--------------------
all

Static Analysis Reports
--------------------

in file fmDbUtils.cpp:

159 bool fm_db_util_get_timestamp(const char *str, FMTimeT &ft){
160 struct timespec ts;
161 memset(&ts, 0, sizeof(ts));
162 // only check if the year is present

   1. Condition strlen(str) < 10, taking false branch.

163 if (strlen(str) < 10){
164 //get the current time
165 clock_gettime(CLOCK_REALTIME, &ts);
166 }else{
167 struct tm t;
168 memset(&t, 0, sizeof(t));
169 strptime(str, "%F %T", &t);
170 ts.tv_sec = mktime(&t);
171 //now get the nanoseconds

   2. alloc_fn: Storage is returned from allocation function strdup.
   3. var_assign: Assigning: tstr = storage returned from strdup(str).

172 char *tstr = strdup(str);
173 strsep(&tstr, ".");

   4. Condition tstr != NULL, taking true branch.

174 if (tstr != NULL){

   5. noescape: Resource tstr is not freed or pointed-to in atol. [Note: The source code implementation of the function has been overridden by a builtin model.]

175 ts.tv_nsec = atol(tstr)*1000;
176 }

    Resource leak (RESOURCE_LEAK)
    6. leaked_storage: Variable tstr going out of scope leaks the storage it points to.

177 }
178 ft = ts.tv_sec*1000000 + ts.tv_nsec/1000;
179 return true;
180}

Ran An (an.ran)
Changed in starlingx:
assignee: nobody → Ran An (an.ran)
Ran An (an.ran)
tags: added: stx.security
Ken Young (kenyis)
Changed in starlingx:
status: New → Triaged
importance: Undecided → High
Revision history for this message
Bruce Jones (brucej) wrote :

Please update this bug with specific file and line number information for the static analysis issue. Make sure the bug has enough information for someone to find the problem in the code without access to the tool or the report.

Ran An (an.ran)
description: updated
Ran An (an.ran)
description: updated
haitao wang (hwang85)
Changed in starlingx:
status: Triaged → Fix Released
Ken Young (kenyis)
tags: added: stx.2019.03
Revision history for this message
Ran An (an.ran) wrote :
Ken Young (kenyis)
information type: Private Security → Public Security
Ken Young (kenyis)
tags: added: stx.2019.05
removed: stx.2019.03
Ken Young (kenyis)
tags: added: stx.2.0
removed: stx.2019.05
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.