Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

multiple potential memory leaks #157

Open
invd opened this issue Apr 24, 2020 · 0 comments
Open

multiple potential memory leaks #157

invd opened this issue Apr 24, 2020 · 0 comments

Comments

@invd
Copy link

invd commented Apr 24, 2020

During recent dynamic program analysis of the code, I noticed that there are a number of cases where allocated memory is not correctly free()'ed. This happens mainly due to suboptimal memory handling in error cases.
The practical impact of the memory leaks is close to zero on normal usage since the command line programs exit after a brief run. As briefly discussed with @nevun, I'm not aware of any security impact.

  1. ykpers-args.c key_tmp
    char *key_tmp = NULL;
    char keybuf[20];
    if(keylocation == 2) {
    const char *prompt = " AES key, 16 bytes (32 characters hex) : ";
    if (key_bytes == 20) {
    prompt = " HMAC key, 20 bytes (40 characters hex) : ";
    }
    if (prompt_for_data(prompt, &key_tmp) != 0) {
    *exit_code = 1;
    return 0;

calloc() via prompt_for_data(), problematic in the return 0; case.

  1. ykpers-args.c uidtmp
    char *uidtmp = NULL;
    if(strncmp(optarg, "uid=", 4) != 0) {
    if(prompt_for_data(" Private ID, 6 bytes (12 characters hex) : ", &uidtmp) != 0) {
    *exit_code = 1;
    return 0;

calloc() via prompt_for_data(), problematic in the return 0; case.

  1. ykpersonalize.c

    I think this should likely go through the error handling (although the exit(1) will properly unclaim the memory as well):
			exit_code = 1;
			goto err;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant