[libvirt] [cim][PATCH 2/2] Fix memory leak in set_input_props

[John Ferlan]

On 12/15/2017 09:05 AM, Adam Majer wrote:
> When caption is specified, cap was allocated and assigned a new pointer
> while the old never freed. Store the old pointer in old_cap and free it
> upon function exit, if required.
> 
> get_input_dev_caption only returns valid cap pointer on success, so
> do not try to free it on failure.
> 
> Signed-off-by: Adam Majer <amajer at suse.de>
> ---
>  src/Virt_SettingsDefineCapabilities.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> > diff --git a/src/Virt_SettingsDefineCapabilities.c
b/src/Virt_SettingsDefineCapabilities.c
> index 85cb27a..e07de59 100644
> --- a/src/Virt_SettingsDefineCapabilities.c
> +++ b/src/Virt_SettingsDefineCapabilities.c
> @@ -1977,10 +1977,9 @@ static CMPIStatus set_input_props(const CMPIObjectPath *ref,
>  {
>          CMPIStatus s = {CMPI_RC_OK, NULL};
>          CMPIInstance *inst;
> -        char *cap;
> +        char *cap, *old_cap = NULL;

Instead of removing, just add "char *tmp;", then....

>  
>          if (get_input_dev_caption(type, bus, &cap) != 1) {
> -                free(cap);
>                  cu_statusf(_BROKER, &s,
>                             CMPI_RC_ERR_NOT_FOUND,
>                             "Unable to build input caption");
> @@ -1988,7 +1987,8 @@ static CMPIStatus set_input_props(const CMPIObjectPath *ref,
>          }
>  
>          if (caption != NULL) {
> -                if (asprintf(&cap, "%s %s", caption, cap) == -1) {

This should be:

   if (&tmp, "%s %s", caption, cap) == -1) {

> +                old_cap = cap;
> +                if (asprintf(&cap, "%s %s", caption, old_cap) == -1) {
>                          cu_statusf(_BROKER, &s,
>                                     CMPI_RC_ERR_NOT_FOUND,
>                                     "Unable to build input caption");

and if successful, e.g. after the closing "}"

    free(cap)
    cap = tmp;

> @@ -2012,6 +2012,7 @@ static CMPIStatus set_input_props(const CMPIObjectPath *ref,
>  
>   out:
>          free(cap);
> +        free(old_cap);

making this one unnecessary.

John


>  
>          return s;
>  }
>