75 lines
4.4 KiB
Diff
75 lines
4.4 KiB
Diff
From d6ff3663d24fd45b31444a4c07d6252dc74fa313 Mon Sep 17 00:00:00 2001
|
|
From: Frantisek Sumsal <frantisek@sumsal.cz>
|
|
Date: Wed, 24 May 2023 11:39:24 +0200
|
|
Subject: [PATCH] specifier: avoid leaking memory on allocation error
|
|
|
|
==8036==ERROR: LeakSanitizer: detected memory leaks
|
|
|
|
Direct leak of 64 byte(s) in 1 object(s) allocated from:
|
|
#0 0x4a10bc in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3
|
|
#1 0x4deef1 in realloc (/build/fuzz-unit-file+0x4deef1)
|
|
#2 0x7ffa35abfe23 in greedy_realloc /work/build/../../src/systemd/src/basic/alloc-util.c:70:13
|
|
#3 0x7ffa35aefad2 in parse_env_file_internal /work/build/../../src/systemd/src/basic/env-file.c:127:38
|
|
#4 0x7ffa35af08a6 in parse_env_file_fdv /work/build/../../src/systemd/src/basic/env-file.c:374:13
|
|
#5 0x7ffa35b6391e in parse_extension_release_atv /work/build/../../src/systemd/src/basic/os-util.c:323:16
|
|
#6 0x7ffa35b63c8a in parse_extension_release_sentinel /work/build/../../src/systemd/src/basic/os-util.c:360:13
|
|
#7 0x7ffa35a5e3f5 in parse_os_release_specifier /work/build/../../src/systemd/src/shared/specifier.c:292:13
|
|
#8 0x7ffa35a5e3f5 in specifier_os_id /work/build/../../src/systemd/src/shared/specifier.c:303:16
|
|
#9 0x7ffa35a5c7f5 in specifier_printf /work/build/../../src/systemd/src/shared/specifier.c:70:45
|
|
#10 0x7ffa3690b279 in unit_full_printf_full /work/build/../../src/systemd/src/core/unit-printf.c:264:16
|
|
#11 0x7ffa367de795 in config_parse_bus_name /work/build/../../src/systemd/src/core/load-fragment.c:2401:13
|
|
#12 0x7ffa358fe5ec in next_assignment /work/build/../../src/systemd/src/shared/conf-parser.c:151:24
|
|
#13 0x7ffa358fe5ec in parse_line /work/build/../../src/systemd/src/shared/conf-parser.c:257:16
|
|
#14 0x7ffa358fd653 in config_parse /work/build/../../src/systemd/src/shared/conf-parser.c:400:21
|
|
#15 0x4de828 in LLVMFuzzerTestOneInput /work/build/../../src/systemd/src/core/fuzz-unit-file.c:72:16
|
|
#16 0x4df208 in NaloFuzzerTestOneInput (/build/fuzz-unit-file+0x4df208)
|
|
#17 0x4fe213 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15
|
|
#18 0x4fd9fa in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:514:3
|
|
#19 0x4ff0c9 in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:757:19
|
|
#20 0x4ffd95 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, std::__Fuzzer::allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:895:5
|
|
#21 0x4ef0ff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:912:6
|
|
#22 0x4ef9c8 in LLVMFuzzerRunDriver /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:925:10
|
|
#23 0x4df485 in main (/build/fuzz-unit-file+0x4df485)
|
|
#24 0x7ffa35232082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee)
|
|
|
|
DEDUP_TOKEN: __interceptor_realloc--realloc--greedy_realloc
|
|
SUMMARY: AddressSanitizer: 64 byte(s) leaked in 1 allocation(s).
|
|
|
|
Found by Nallocfuzz.
|
|
|
|
(cherry picked from commit 6c13a39ac731a23c38685aa65b38bc0b10449b81)
|
|
(cherry picked from commit b4c9a9bfca3b65a573329056095961446462aae9)
|
|
(cherry picked from commit 6b8b0f5dcaec4e8e4a64f8ce4cdda5c0db9da42c)
|
|
|
|
Conflict:modify the corresponding memory leakage issue in the function specifier_os_release_common
|
|
Reference:https://github.com/systemd/systemd-stable/commit/d6ff3663d24fd45b31444a4c07d6252dc74fa313
|
|
---
|
|
src/shared/specifier.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/shared/specifier.c b/src/shared/specifier.c
|
|
index cb4d6da..5782175 100644
|
|
--- a/src/shared/specifier.c
|
|
+++ b/src/shared/specifier.c
|
|
@@ -211,7 +211,7 @@ int specifier_architecture(char specifier, const void *data, const char *root, c
|
|
}
|
|
|
|
static int specifier_os_release_common(const char *field, const char *root, char **ret) {
|
|
- char *t = NULL;
|
|
+ _cleanup_free_ char *t = NULL;
|
|
int r;
|
|
|
|
r = parse_os_release(root, field, &t);
|
|
@@ -225,7 +225,7 @@ static int specifier_os_release_common(const char *field, const char *root, char
|
|
return -ENOMEM;
|
|
}
|
|
|
|
- *ret = t;
|
|
+ *ret = TAKE_PTR(t);
|
|
return 0;
|
|
}
|
|
|
|
--
|
|
2.33.0
|
|
|