Re: [PATCH] ldconfig: Fix memory leaks

[Adhemerval Zanella <adhemerval.zanella@linaro.org>]

On 11/05/2021 14:16, Siddhesh Poyarekar via Libc-alpha wrote:
> Coverity discovered that paths allocated by chroot_canon are not freed
> in a couple of routines in ldconfig.

LGTM, just a clarification about a specific change below.

As a side note, reviewing this patch I think chroot_canon can be replaced
with realpath.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

> ---
>  elf/ldconfig.c | 23 +++++++++++++++--------
>  1 file changed, 15 insertions(+), 8 deletions(-)
> 
> diff --git a/elf/ldconfig.c b/elf/ldconfig.c
> index 28ed637a29..3192aa49d9 100644
> --- a/elf/ldconfig.c
> +++ b/elf/ldconfig.c
> @@ -693,8 +693,7 @@ manual_link (char *library)
>        if (real_path == NULL)
>  	{
>  	  error (0, errno, _("Can't find %s"), path);
> -	  free (path);
> -	  return;
> +	  goto out;
>  	}
>        real_library = alloca (strlen (real_path) + strlen (libname) + 2);
>        sprintf (real_library, "%s/%s", real_path, libname);

Why do you need this since 'real_path' does not need to be freed here ?

> @@ -709,16 +708,14 @@ manual_link (char *library)
>    if (lstat64 (real_library, &stat_buf))
>      {
>        error (0, errno, _("Cannot lstat %s"), library);
> -      free (path);
> -      return;
> +      goto out;
>      }
>    /* We don't want links here!  */

Ok.

>    else if (!S_ISREG (stat_buf.st_mode))
>      {
>        error (0, 0, _("Ignored file %s since it is not a regular file."),
>  	     library);
> -      free (path);
> -      return;
> +      goto out;
>      }
>  

Ok.

>    if (process_file (real_library, library, libname, &flag, &osversion,
> @@ -726,14 +723,16 @@ manual_link (char *library)
>      {
>        error (0, 0, _("No link created since soname could not be found for %s"),
>  	     library);
> -      free (path);
> -      return;
> +      goto out;
>      }

Ok.

>    if (soname == NULL)
>      soname = implicit_soname (libname, flag);
>    create_links (real_path, path, libname, soname);
>    free (soname);
> +out:
>    free (path);
> +  if (path != real_path)
> +    free (real_path);
>  }
>  
>  

Ok.

> @@ -920,8 +919,16 @@ search_dir (const struct dir_entry *entry)
>  	      /* Remove stale symlinks.  */
>  	      if (opt_link && strstr (direntry->d_name, ".so."))
>  		unlink (real_file_name);
> +
> +	      if (opt_chroot)
> +		free (target_name);
> +

Ok, 'opt_chroot' being not null means it was allocated using chroot_canon
instead of alloca.  No implicit checks though.

>  	      continue;
>  	    }
> +
> +	  if (opt_chroot)
> +	    free (target_name);
> +

Ok.

>  	  is_dir = S_ISDIR (stat_buf.st_mode);
>  
>  	  /* lstat_buf is later stored, update contents.  */
>