From: Sudarshan sudarshan.bisht@nokia.com
Coverity Static Analysis helps developers find hard-to-spot, yet potentially crash-causing defects early in the development phase, reducing the cost,time, and risk of software errors. This patch has a fix for conditions where 1) variable is used evern after getting freed thus causing junk assignment and 2) double free of memory.
Sudarshan (1): alsa-lib: fixed coverity reported issues under "USE_AFTER_FREE" checker.
src/control/control_hw.c | 1 + src/mixer/mixer.c | 2 +- 2 files changed, 2 insertions(+), 1 deletions(-)
From: Sudarshan sudarshan.bisht@nokia.com
--- src/control/control_hw.c | 1 + src/mixer/mixer.c | 2 +- 2 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/src/control/control_hw.c b/src/control/control_hw.c index cf258b4..a8463c1 100644 --- a/src/control/control_hw.c +++ b/src/control/control_hw.c @@ -414,6 +414,7 @@ int snd_ctl_hw_open(snd_ctl_t **handle, const char *name, int card, int mode) if (err < 0) { close(fd); free(hw); + hw = NULL; } ctl->ops = &snd_ctl_hw_ops; ctl->private_data = hw; diff --git a/src/mixer/mixer.c b/src/mixer/mixer.c index 85d843f..0f4f1ac 100644 --- a/src/mixer/mixer.c +++ b/src/mixer/mixer.c @@ -205,7 +205,7 @@ int snd_mixer_attach(snd_mixer_t *mixer, const char *name) return err; err = snd_mixer_attach_hctl(mixer, hctl); if (err < 0) { - snd_hctl_close(hctl); + /* ideally hctl should be freed here, but it's taken care in snd_mixer_attach_hctl*/ return err; } return 0;
sudarshan.bisht@nokia.com wrote:
--- a/src/control/control_hw.c +++ b/src/control/control_hw.c @@ -414,6 +414,7 @@ int snd_ctl_hw_open(snd_ctl_t **handle, const char *name, int card, int mode) if (err < 0) { close(fd); free(hw);
hw = NULL;
In this place, it's just a "return err" that is missing.
--- a/src/mixer/mixer.c +++ b/src/mixer/mixer.c @@ -205,7 +205,7 @@ int snd_mixer_attach(snd_mixer_t *mixer, const char *name) return err; err = snd_mixer_attach_hctl(mixer, hctl); if (err < 0) {
snd_hctl_close(hctl);
/* ideally hctl should be freed here, but it's taken care in snd_mixer_attach_hctl*/
If the calloc() in snd_mixer_attach_hctl() fails, hctl is not freed. The bug is the inconsistent error handling cleanup in snd_mixer_attach_hctl(); I think it shouldn't free its hctl in any case.
Regards, Clemens
On Thu, 2011-03-17 at 12:22 +0100, ext Clemens Ladisch wrote:
sudarshan.bisht@nokia.com wrote:
--- a/src/control/control_hw.c +++ b/src/control/control_hw.c @@ -414,6 +414,7 @@ int snd_ctl_hw_open(snd_ctl_t **handle, const char *name, int card, int mode) if (err < 0) { close(fd); free(hw);
hw = NULL;In this place, it's just a "return err" that is missing.
Ok.
--- a/src/mixer/mixer.c +++ b/src/mixer/mixer.c @@ -205,7 +205,7 @@ int snd_mixer_attach(snd_mixer_t *mixer, const char *name) return err; err = snd_mixer_attach_hctl(mixer, hctl); if (err < 0) {
snd_hctl_close(hctl);
/* ideally hctl should be freed here, but it's taken care in snd_mixer_attach_hctl*/If the calloc() in snd_mixer_attach_hctl() fails, hctl is not freed. The bug is the inconsistent error handling cleanup in snd_mixer_attach_hctl(); I think it shouldn't free its hctl in any case.
Ok, I will remove freeing of hctl from snd_mixer_attach_hctl().
Regards, Clemens
Br, Sudarshan Bisht
-
Clemens Ladisch -
Sudarshan Bisht -
sudarshan.bisht＠nokia.com