From 5dcc52a486f27867bdb685a39e10fadc9e6afa6f Mon Sep 17 00:00:00 2001 From: Bastien Nocera Date: Tue, 2 Jul 2024 16:23:40 +0200 Subject: [PATCH] sdp: Fix memory leak in sdp_data_alloc*() Make sure to free already allocated memory if we run out of memory before the end of the loop. Error: RESOURCE_LEAK (CWE-772): [#def8] [important] lib/sdp.c:542:4: alloc_fn: Storage is returned from allocation function "sdp_data_alloc". lib/sdp.c:542:4: var_assign: Assigning: "data" = storage returned from "sdp_data_alloc(dtd, values[i])". lib/sdp.c:550:4: var_assign: Assigning: "seq" = "data". lib/sdp.c:552:3: var_assign: Assigning: "curr" = "data". lib/sdp.c:553:2: out_of_scope: Variable "data" goes out of scope. lib/sdp.c:552:3: overwrite_var: Overwriting "curr" in "curr = data". lib/sdp.c:545:4: leaked_storage: Variable "seq" going out of scope leaks the storage it points to. 543| 544| if (!data) 545|-> return NULL; 546| 547| if (curr) --- lib/sdp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/sdp.c b/lib/sdp.c index 2e66505b2..b87951b00 100644 --- a/lib/sdp.c +++ b/lib/sdp.c @@ -513,8 +513,10 @@ sdp_data_t *sdp_seq_alloc_with_length(void **dtds, void **values, int *length, else data = sdp_data_alloc_with_length(dtd, values[i], length[i]); - if (!data) + if (!data) { + sdp_data_free(seq); return NULL; + } if (curr) curr->next = data; @@ -541,8 +543,10 @@ sdp_data_t *sdp_seq_alloc(void **dtds, void **values, int len) else data = sdp_data_alloc(dtd, values[i]); - if (!data) + if (!data) { + sdp_data_free(seq); return NULL; + } if (curr) curr->next = data; -- 2.47.3