Menu
▾
▴
[devel] [PATCH 2/2] imm: fix realloc failure handling in XML import [#3398]
|
From: Thien H. <thi...@en...> - 2026-05-12 08:39:43
|
Fix potential memory leaks in imm_loader.cc, imm_cfg.c, and
imm_import.cc where the result of realloc() was assigned directly
to the original pointer. If realloc() fails and returns NULL, the
original memory is leaked.
Use a temporary variable to hold the realloc() result, check for
NULL, and only then assign back to the original pointer. Also add
missing NULL checks and proper cleanup on failure paths.
---
src/imm/immloadd/imm_loader.cc | 23 +++++++++++++----
src/imm/tools/imm_cfg.c | 47 +++++++++++++++++++++++++++-------
src/imm/tools/imm_import.cc | 19 ++++++++++----
3 files changed, 70 insertions(+), 19 deletions(-)
diff --git a/src/imm/immloadd/imm_loader.cc b/src/imm/immloadd/imm_loader.cc
index 2ab3ae768..c19911ace 100644
--- a/src/imm/immloadd/imm_loader.cc
+++ b/src/imm/immloadd/imm_loader.cc
@@ -1344,12 +1344,15 @@ static void charactersHandler(void *userData, const xmlChar *chars, int len) {
/* Copy the distinguished name */
if (state->objectName) {
- state->objectName = (char *)realloc(
+ char *object_name = (char *)realloc(
state->objectName, strlen(state->objectName) + len + 1);
- if (state->objectName == NULL) {
+ if (object_name == NULL) {
LOG_ER("Failed to realloc state->objectName");
+ free(state->objectName);
+ state->objectName = NULL;
exit(1);
}
+ state->objectName = object_name;
strncat(state->objectName, (const char *)chars, (size_t)len);
} else {
state->objectName = (char *)malloc((size_t)len + 1);
@@ -1373,12 +1376,15 @@ static void charactersHandler(void *userData, const xmlChar *chars, int len) {
strncpy(state->attrName, (const char *)chars, (size_t)len);
state->attrName[len] = '\0';
} else {
- state->attrName =
+ char *attr_name =
(char *)realloc(state->attrName, strlen(state->attrName) + len + 1);
- if (state->attrName == NULL) {
+ if (attr_name == NULL) {
LOG_ER("Failed to realloc state->attrName");
+ free(state->attrName);
+ state->attrName = NULL;
exit(1);
}
+ state->attrName = attr_name;
strncat(state->attrName, (const char *)chars, len);
}
@@ -1485,8 +1491,15 @@ static void charactersHandler(void *userData, const xmlChar *chars, int len) {
* call for same value */
assert(state->attrDefaultValueSet);
int newlen = strlen(state->attrDefaultValueBuffer) + len;
- state->attrDefaultValueBuffer = (char *)realloc(
+ char *default_value = (char *)realloc(
(void *)state->attrDefaultValueBuffer, (size_t)newlen + 1);
+ if (default_value == NULL) {
+ LOG_ER("Failed to realloc state->attrDefaultValueBuffer");
+ free(state->attrDefaultValueBuffer);
+ state->attrDefaultValueBuffer = NULL;
+ exit(1);
+ }
+ state->attrDefaultValueBuffer = default_value;
strncat(state->attrDefaultValueBuffer, (const char *)chars,
(size_t)len);
state->attrDefaultValueBuffer[newlen] = '\0';
diff --git a/src/imm/tools/imm_cfg.c b/src/imm/tools/imm_cfg.c
index b4972c874..f25cf49c5 100644
--- a/src/imm/tools/imm_cfg.c
+++ b/src/imm/tools/imm_cfg.c
@@ -574,11 +574,17 @@ int object_create(const SaNameT **objectNames, const SaImmClassNameT className,
while (attrValues[j]) {
if (!strcmp(attrValue->attrName,
attrValues[j]->attrName)) {
- attrValues[j]->attrValues = realloc(
- attrValues[j]->attrValues,
- (attrValues[j]->attrValuesNumber +
- 1) *
- sizeof(SaImmAttrValueT *));
+ SaImmAttrValueT *tmp_attr_values =
+ realloc(attrValues[j]->attrValues,
+ (attrValues[j]->attrValuesNumber +
+ 1) *
+ sizeof(SaImmAttrValueT *));
+ if (tmp_attr_values == NULL) {
+ fprintf(stderr, "realloc() error\n");
+ free_attr_values(attrValue);
+ goto done;
+ }
+ attrValues[j]->attrValues = tmp_attr_values;
attrValues[j]->attrValues
[attrValues[j]->attrValuesNumber] =
attrValue->attrValues[0];
@@ -613,8 +619,15 @@ int object_create(const SaNameT **objectNames, const SaImmClassNameT className,
attrAdded = false;
}
- attrValues =
- realloc(attrValues, (attr_len + 1) * sizeof(SaImmAttrValuesT_2 *));
+ {
+ SaImmAttrValuesT_2 **tmp_attr_values = realloc(
+ attrValues, (attr_len + 1) * sizeof(SaImmAttrValuesT_2 *));
+ if (tmp_attr_values == NULL) {
+ fprintf(stderr, "realloc() error\n");
+ goto done;
+ }
+ attrValues = tmp_attr_values;
+ }
attrValues[attr_len] = NULL;
if (ccbHandle == -1) {
@@ -1477,9 +1490,17 @@ static char *readinput(char *prompt)
if (line[len - 1] == '\\') {
line[len - 1] = 0;
if (rdlen) {
- rdline = realloc(rdline, rdlen + len);
+ char *tmp = realloc(rdline, rdlen + len);
+ if (tmp == NULL) {
+ free(line);
+ if (rdline)
+ free(rdline);
+ return NULL;
+ }
+ rdline = tmp;
strncat(rdline, line, len + 1);
rdlen += len - 1;
+ free(line);
} else {
rdline = line;
rdlen = len;
@@ -1487,8 +1508,16 @@ static char *readinput(char *prompt)
pmt = NULL;
} else {
if (rdline) {
- rdline = realloc(rdline, rdlen + len + 1);
+ char *tmp = realloc(rdline, rdlen + len + 1);
+ if (tmp == NULL) {
+ free(line);
+ if (rdline)
+ free(rdline);
+ return NULL;
+ }
+ rdline = tmp;
strncat(rdline, line, len + 1);
+ free(line);
} else
rdline = line;
diff --git a/src/imm/tools/imm_import.cc b/src/imm/tools/imm_import.cc
index 861c761bd..896fed7fa 100644
--- a/src/imm/tools/imm_import.cc
+++ b/src/imm/tools/imm_import.cc
@@ -1783,14 +1783,15 @@ static void charactersHandler(void *userData, const xmlChar *chars, int len) {
}
if (state->objectName) {
- state->objectName = (char *)realloc(
+ char *object_name = (char *)realloc(
state->objectName, strlen(state->objectName) + len + 1);
- if (state->objectName == NULL) {
+ if (object_name == NULL) {
LOG_ER("Failed to realloc state->objectName");
stopParser(state);
state->parsingStatus = 1;
return;
}
+ state->objectName = object_name;
strncat(state->objectName, (const char *)chars, (size_t)len);
} else {
state->objectName = (char *)malloc((size_t)len + 1);
@@ -1818,14 +1819,15 @@ static void charactersHandler(void *userData, const xmlChar *chars, int len) {
strncpy(state->attrName, (const char *)chars, (size_t)len);
state->attrName[len] = '\0';
} else {
- state->attrName =
+ char *attr_name =
(char *)realloc(state->attrName, strlen(state->attrName) + len + 1);
- if (state->attrName == NULL) {
+ if (attr_name == NULL) {
LOG_ER("Failed to realloc state->attrName");
stopParser(state);
state->parsingStatus = 1;
return;
}
+ state->attrName = attr_name;
strncat(state->attrName, (const char *)chars, len);
}
@@ -1943,8 +1945,15 @@ static void charactersHandler(void *userData, const xmlChar *chars, int len) {
* call for same value */
assert(state->attrDefaultValueSet);
int newlen = strlen(state->attrDefaultValueBuffer) + len;
- state->attrDefaultValueBuffer = (char *)realloc(
+ char *default_value = (char *)realloc(
(void *)state->attrDefaultValueBuffer, (size_t)newlen + 1);
+ if (default_value == NULL) {
+ LOG_ER("Failed to realloc state->attrDefaultValueBuffer");
+ stopParser(state);
+ state->parsingStatus = 1;
+ return;
+ }
+ state->attrDefaultValueBuffer = default_value;
strncat(state->attrDefaultValueBuffer, (const char *)chars,
(size_t)len);
state->attrDefaultValueBuffer[newlen] = '\0';
--
2.34.1
The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Any opinions expressed are mine and do not necessarily represent the opinions of the Company. Emails are susceptible to interference. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is strictly prohibited and may be unlawful. If you have received this message in error, do not open any attachments but please notify the Endava Service Desk on (+44 (0)870 423 0187), and delete this message from your system. The sender accepts no responsibility for information, errors or omissions in this email, or for its use or misuse, or for any act committed or omitted in connection with this communication. If in doubt, please verify the authenticity of the contents with the sender. Please rely on your own virus checkers as no responsibility is taken by the sender for any damage rising out of any bug or virus infection.
Endava plc is a company registered in England under company number 5722669 whose registered office is at 125 Old Broad Street, London, EC2N 1AR, United Kingdom. Endava plc is the Endava group holding company and does not provide any services to clients. Each of Endava plc and its subsidiaries is a separate legal entity and has no liability for another such entity's acts or omissions.
|
