From 7076be534597dadba5c3b3bcfdd10a93333fbc43 Mon Sep 17 00:00:00 2001
From: Tomas Popela <tpopela@redhat.com>
Date: Fri, 12 Oct 2018 12:11:32 +0200
Subject: [PATCH 16/17] Fix possible double free
Error: CLANG_WARNING:
yelp-3.28.1/libyelp/yelp-uri.c:931:5: warning: Attempt to free released memory
g_free (query);
^
yelp-3.28.1/libyelp/yelp-uri.c:259:9: note: Assuming the condition is false
if (priv->doctype != YELP_URI_DOCUMENT_TYPE_UNRESOLVED)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:259:5: note: Taking false branch
if (priv->doctype != YELP_URI_DOCUMENT_TYPE_UNRESOLVED)
^
yelp-3.28.1/libyelp/yelp-uri.c:262:9: note: Assuming the condition is false
if (priv->res_base)
^~~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:262:5: note: Taking false branch
if (priv->res_base)
^
yelp-3.28.1/libyelp/yelp-uri.c:266:5: note: Calling 'resolve_sync'
resolve_sync (uri);
^~~~~~~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:311:9: note: Assuming the condition is false
if (g_str_has_prefix (priv->res_arg, "ghelp:")
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:311:9: note: Left side of '||' is false
yelp-3.28.1/libyelp/yelp-uri.c:312:12: note: Assuming the condition is false
|| g_str_has_prefix (priv->res_arg, "gnome-help:")) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:311:5: note: Taking false branch
if (g_str_has_prefix (priv->res_arg, "ghelp:")
^
yelp-3.28.1/libyelp/yelp-uri.c:315:14: note: Assuming the condition is true
else if (g_str_has_prefix (priv->res_arg, "help:")) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:315:10: note: Taking true branch
else if (g_str_has_prefix (priv->res_arg, "help:")) {
^
yelp-3.28.1/libyelp/yelp-uri.c:316:9: note: Calling 'resolve_help_uri'
resolve_help_uri (uri);
^~~~~~~~~~~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:856:9: note: Assuming 'colon' is non-null
if (!colon) {
^~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:856:5: note: Taking false branch
if (!colon) {
^
yelp-3.28.1/libyelp/yelp-uri.c:862:21: note: Assuming the condition is true
for (c = colon; *c != '\0'; c++) {
^~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:862:5: note: Loop condition is true. Entering loop body
for (c = colon; *c != '\0'; c++) {
^
yelp-3.28.1/libyelp/yelp-uri.c:863:13: note: Assuming the condition is false
if (*c == '#' && hash == NULL)
^~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:863:23: note: Left side of '&&' is false
if (*c == '#' && hash == NULL)
^
yelp-3.28.1/libyelp/yelp-uri.c:865:18: note: Assuming the condition is false
else if (*c == '?' && query == NULL && hash == NULL)
^~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:865:28: note: Left side of '&&' is false
else if (*c == '?' && query == NULL && hash == NULL)
^
yelp-3.28.1/libyelp/yelp-uri.c:867:18: note: Assuming the condition is false
else if (*c == '/' && slash == NULL && query == NULL && hash == NULL)
^~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:867:28: note: Left side of '&&' is false
else if (*c == '/' && slash == NULL && query == NULL && hash == NULL)
^
yelp-3.28.1/libyelp/yelp-uri.c:862:21: note: Assuming the condition is true
for (c = colon; *c != '\0'; c++) {
^~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:862:5: note: Loop condition is true. Entering loop body
for (c = colon; *c != '\0'; c++) {
^
yelp-3.28.1/libyelp/yelp-uri.c:863:13: note: Assuming the condition is false
if (*c == '#' && hash == NULL)
^~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:863:23: note: Left side of '&&' is false
if (*c == '#' && hash == NULL)
^
yelp-3.28.1/libyelp/yelp-uri.c:865:18: note: Assuming the condition is true
else if (*c == '?' && query == NULL && hash == NULL)
^~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:865:18: note: Left side of '&&' is true
yelp-3.28.1/libyelp/yelp-uri.c:865:18: note: Left side of '&&' is true
yelp-3.28.1/libyelp/yelp-uri.c:865:14: note: Taking true branch
else if (*c == '?' && query == NULL && hash == NULL)
^
yelp-3.28.1/libyelp/yelp-uri.c:862:21: note: Assuming the condition is true
for (c = colon; *c != '\0'; c++) {
^~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:862:5: note: Loop condition is true. Entering loop body
for (c = colon; *c != '\0'; c++) {
^
yelp-3.28.1/libyelp/yelp-uri.c:863:13: note: Assuming the condition is true
if (*c == '#' && hash == NULL)
^~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:863:13: note: Left side of '&&' is true
yelp-3.28.1/libyelp/yelp-uri.c:863:9: note: Taking true branch
if (*c == '#' && hash == NULL)
^
yelp-3.28.1/libyelp/yelp-uri.c:862:21: note: Assuming the condition is false
for (c = colon; *c != '\0'; c++) {
^~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:862:5: note: Loop condition is false. Execution continues on line 871
for (c = colon; *c != '\0'; c++) {
^
yelp-3.28.1/libyelp/yelp-uri.c:871:9: note: Left side of '||' is false
if (slash || query || hash)
^
yelp-3.28.1/libyelp/yelp-uri.c:871:24: note: Left side of '||' is true
if (slash || query || hash)
^
yelp-3.28.1/libyelp/yelp-uri.c:873:32: note: '?' condition is false
(slash ? slash : (query ? query : hash)) - colon - 1);
^
yelp-3.28.1/libyelp/yelp-uri.c:873:49: note: '?' condition is true
(slash ? slash : (query ? query : hash)) - colon - 1);
^
yelp-3.28.1/libyelp/yelp-uri.c:877:15: note: Left side of '&&' is false
if (slash && (query || hash))
^
yelp-3.28.1/libyelp/yelp-uri.c:880:10: note: Taking false branch
else if (slash)
^
yelp-3.28.1/libyelp/yelp-uri.c:883:9: note: Assuming 'query' is null
if (query && hash)
^~~~~
yelp-3.28.1/libyelp/yelp-uri.c:883:15: note: Left side of '&&' is false
if (query && hash)
^
yelp-3.28.1/libyelp/yelp-uri.c:886:14: note: Assuming 'query' is null
else if (query)
^~~~~
yelp-3.28.1/libyelp/yelp-uri.c:886:10: note: Taking false branch
else if (query)
^
yelp-3.28.1/libyelp/yelp-uri.c:889:9: note: Assuming 'query' is null
if (query) {
^~~~~
yelp-3.28.1/libyelp/yelp-uri.c:889:5: note: Taking false branch
if (query) {
^
yelp-3.28.1/libyelp/yelp-uri.c:907:9: note: Assuming 'hash' is null
if (hash)
^~~~
yelp-3.28.1/libyelp/yelp-uri.c:907:5: note: Taking false branch
if (hash)
^
yelp-3.28.1/libyelp/yelp-uri.c:910:22: note: '?' condition is false
priv->page_id = (slash ? slash : g_strdup ("index"));
^
yelp-3.28.1/libyelp/yelp-uri.c:913:9: note: Assuming 'hash' is non-null
if (hash)
^~~~
yelp-3.28.1/libyelp/yelp-uri.c:913:5: note: Taking true branch
if (hash)
^
yelp-3.28.1/libyelp/yelp-uri.c:915:9: note: Assuming the condition is true
if (priv->frag_id && g_str_has_prefix (priv->frag_id, "search=")) {
^~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:915:9: note: Left side of '&&' is true
yelp-3.28.1/libyelp/yelp-uri.c:915:26: note: Assuming the condition is true
if (priv->frag_id && g_str_has_prefix (priv->frag_id, "search=")) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:915:5: note: Taking true branch
if (priv->frag_id && g_str_has_prefix (priv->frag_id, "search=")) {
^
yelp-3.28.1/libyelp/yelp-uri.c:916:9: note: Memory is released
g_free (priv->frag_id);
^~~~~~~~~~~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:923:34: note: Assuming the condition is false
priv->page_id ? "/" : "",
^~~~~~~~~~~~~
yelp-3.28.1/libyelp/yelp-uri.c:923:34: note: '?' condition is false
yelp-3.28.1/libyelp/yelp-uri.c:924:34: note: '?' condition is false
priv->page_id ? priv->page_id : "",
^
yelp-3.28.1/libyelp/yelp-uri.c:925:34: note: Assuming 'query' is non-null
query ? "?" : "",
^~~~~
yelp-3.28.1/libyelp/yelp-uri.c:925:34: note: '?' condition is true
yelp-3.28.1/libyelp/yelp-uri.c:926:34: note: '?' condition is true
query ? query : "",
^
yelp-3.28.1/libyelp/yelp-uri.c:927:34: note: '?' condition is false
priv->frag_id ? "#" : "",
^
yelp-3.28.1/libyelp/yelp-uri.c:928:34: note: '?' condition is false
priv->frag_id ? priv->frag_id : "",
^
yelp-3.28.1/libyelp/yelp-uri.c:931:5: note: Attempt to free released memory
g_free (query);
^~~~~~~~~~~~~~
929| NULL);
930|
931|-> g_free (query);
932| g_free (document);
933| return;
---
libyelp/yelp-uri.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libyelp/yelp-uri.c b/libyelp/yelp-uri.c
index f20b167e..385cb837 100644
--- a/libyelp/yelp-uri.c
+++ b/libyelp/yelp-uri.c
@@ -928,7 +928,8 @@ resolve_help_uri (YelpUri *uri)
priv->frag_id ? priv->frag_id : "",
NULL);
- g_free (query);
+ if (query)
+ g_free (query);
g_free (document);
return;
}
--
2.19.1