[CONC-333] covscan: bad_free Created: 2018-05-24  Updated: 2018-07-20  Resolved: 2018-07-20

Status: Closed
Project: MariaDB Connector/C
Component/s: None
Affects Version/s: 3.0.4
Fix Version/s: 3.0.6

Type: Bug Priority: Major
Reporter: Michal Schorm Assignee: Georg Richter
Resolution: Fixed Votes: 0
Labels: None

Attachments: HTML File report-ce69df.html    

 Description   

covscan says:

Error: BAD_FREE (CWE-763):
mariadb-connector-c-3.0.4-src/libmariadb/mariadb_lib.c:1597: address_free: "mysql_init" frees address of "tmp_mysql".
mariadb-connector-c-3.0.4-src/libmariadb/mariadb_lib.c:1007:5: freed_arg: "free" frees parameter "mysql".
mariadb-connector-c-3.0.4-src/libmariadb/mariadb_lib.c:1628: address_free: "mysql_close" frees address of "tmp_mysql".
mariadb-connector-c-3.0.4-src/libmariadb/mariadb_lib.c:1940:7: freed_arg: "free" frees parameter "mysql".
# 1938|       mysql->net.pvio= 0;
# 1939|       if (mysql->free_me)
# 1940|->       free(mysql);
# 1941|     }
# 1942|     return;

I tried to check that in the source code. It doesn't look like false positive to me, so I'm sending this to you to be sure.



 Comments   
Comment by Daniel Black [ 2018-07-02 ]

Found the same with clang analyser on the server code. Attached html shows call path to reach this branch.

Comment by Daniel Black [ 2018-07-02 ]

tmp_mysql.free_me= 0 on line 1652 perhaps.

Comment by Georg Richter [ 2018-07-20 ]

It is a false positive - however it was fixed by initializing free_me after mysql_init.

Generated at Thu Feb 08 03:04:33 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.