#9698 Static code analysis defects
Closed: fixed by rcritten. Opened by frenaud.

Issue

OpenScan Hub reported the following issues against ipa 4.12:

Use after free

4. freeipa-4.12.2/client/ipa-rmkeytab.c:149:9: freed_arg: "krb5_kt_end_seq_get" frees "kt_cursor".
9. freeipa-4.12.2/client/ipa-rmkeytab.c:179:5: double_free: Calling "krb5_kt_end_seq_get" frees pointer "kt_cursor" which has already been freed.
#   177|   
#   178|   done:
#   179|->     krb5_kt_end_seq_get(context, ktid, &kt_cursor);
#   180|       krb5_free_unparsed_name(context, entry_princ_s);
#   181|       return rval;

Resource leaks

4. freeipa-4.12.2/daemons/ipa-otpd/forward.c:50:9: alloc_fn: Storage is returned from allocation function "krb5_get_error_message".
5. freeipa-4.12.2/daemons/ipa-otpd/forward.c:50:9: noescape: Resource "krb5_get_error_message(ctx.kctx, retval)" is not freed or pointed-to in "otpd_log_req_".
6. freeipa-4.12.2/daemons/ipa-otpd/forward.c:50:9: leaked_storage: Failing to save or free storage allocated by "krb5_get_error_message(ctx.kctx, retval)" leaks it.
#    48|       } else {
#    49|           const char *err_msg = krb5_get_error_message(ctx.kctx, retval);
#    50|->         otpd_log_req(item->req, "forward end: %s",
#    51|                        krb5_get_error_message(ctx.kctx, retval));
#    52|           krb5_free_error_message(ctx.kctx, err_msg);

Metadata Update from @rcritten:
- Issue assigned to rcritten

PR https://github.com/freeipa/freeipa/pull/7693

master:

  • 0dee69d771025f9e2780a592f3a3b82bb75032be Fix some memory errors identified by a static analyzer

ipa-4-12:

  • c87b695ab0211e9cd337e4d148c3cc0ee56a232c Fix some memory errors identified by a static analyzer

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata