{"push_id":2831068222,"size":6,"distinct_size":6,"ref":"refs/heads/master","head":"2f451dbf4e83c751f6bbba7ed26d90bf275fcbf7","before":"2b2283d3e27faf77999eab78111a46e573f6f9cc","commits":[{"sha":"b24351183ec574f81c729cbb3286aceaee3f03c8","author":{"name":"Tomas Hozza","email":"2152b765a3a51268598a4503265cd77ce732fa8c@redhat.com"},"message":"* src/ftp.c (getftp): Fix RESOURCE LEAK found by Coverity\n\nError: RESOURCE_LEAK (CWE-772):\nwget-1.19.5/src/ftp.c:1493: alloc_fn: Storage is returned from allocation function \"fopen\".\nwget-1.19.5/src/ftp.c:1493: var_assign: Assigning: \"fp\" = storage returned from \"fopen(con->target, \"wb\")\".\nwget-1.19.5/src/ftp.c:1811: leaked_storage: Variable \"fp\" going out of scope leaks the storage it points to.\n\\# 1809|     if (fp && !output_stream)\n\\# 1810|       fclose (fp);\n\\# 1811|->   return err;\n\\# 1812|   }\n\\# 1813|\n\nIt can happen, that \"if (!output_stream || con->cmd & DO_LIST)\" on line #1398 can be true, even though \"output_stream != NULL\". In this case a new file is opened to \"fp\". Later it may happen in the FTPS branch, that some error will occure and code will jump to label \"exit_error\". In \"exit_error\", the \"fp\" is closed only if \"output_stream == NULL\". However this may not be true as described earlier and \"fp\" leaks.\n\nOn line #1588, there is the following conditional free of \"fp\":\n\n  /* Close the local file.  */\n  if (!output_stream || con->cmd & DO_LIST)\n    fclose (fp);\n\nTherefore the conditional at the end of the function after \"exit_error\" label should be modified to:\n\n  if (fp && (!output_stream || con->cmd & DO_LIST))\n    fclose (fp);\n\nThis will ensure that \"fp\" does not leak in any case it sould be opened.\n\nSigned-off-by: Tomas Hozza <thozza@redhat.com>","distinct":true,"url":"https://api.github.com/repos/dstw/wget/commits/b24351183ec574f81c729cbb3286aceaee3f03c8"},{"sha":"b8be904ac7c25387672b0aa39f7cba699bffc48e","author":{"name":"Tomas Hozza","email":"2152b765a3a51268598a4503265cd77ce732fa8c@redhat.com"},"message":"* src/http.c (check_auth): Fix RESOURCE LEAK found by Coverity\n\nError: RESOURCE_LEAK (CWE-772):\nwget-1.19.5/src/http.c:2434: alloc_fn: Storage is returned from allocation function \"xmalloc\".\nwget-1.19.5/lib/xmalloc.c:41:11: alloc_fn: Storage is returned from allocation function \"malloc\".\nwget-1.19.5/lib/xmalloc.c:41:11: var_assign: Assigning: \"p\" = \"malloc(n)\".\nwget-1.19.5/lib/xmalloc.c:44:3: return_alloc: Returning allocated memory \"p\".\nwget-1.19.5/src/http.c:2434: var_assign: Assigning: \"auth_stat\" = storage returned from \"xmalloc(4UL)\".\nwget-1.19.5/src/http.c:2446: noescape: Resource \"auth_stat\" is not freed or pointed-to in \"create_authorization_line\".\nwget-1.19.5/src/http.c:5203:70: noescape: \"create_authorization_line(char const *, char const *, char const *, char const *, char const *, _Bool *, uerr_t *)\" does not free or save its parameter \"auth_err\".\nwget-1.19.5/src/http.c:2476: leaked_storage: Variable \"auth_stat\" going out of scope leaks the storage it points to.\n\\# 2474|                 /* Creating the Authorization header went wrong */\n\\# 2475|               }\n\\# 2476|->         }\n\\# 2477|         else\n\\# 2478|           {\n\nError: RESOURCE_LEAK (CWE-772):\nwget-1.19.5/src/http.c:2431: alloc_fn: Storage is returned from allocation function \"url_full_path\".\nwget-1.19.5/src/url.c:1105:19: alloc_fn: Storage is returned from allocation function \"xmalloc\".\nwget-1.19.5/lib/xmalloc.c:41:11: alloc_fn: Storage is returned from allocation function \"malloc\".\nwget-1.19.5/lib/xmalloc.c:41:11: var_assign: Assigning: \"p\" = \"malloc(n)\".\nwget-1.19.5/lib/xmalloc.c:44:3: return_alloc: Returning allocated memory \"p\".\nwget-1.19.5/src/url.c:1105:19: var_assign: Assigning: \"full_path\" = \"xmalloc(length + 1)\".\nwget-1.19.5/src/url.c:1107:3: noescape: Resource \"full_path\" is not freed or pointed-to in function \"full_path_write\".\nwget-1.19.5/src/url.c:1078:47: noescape: \"full_path_write(struct url const *, char *)\" does not free or save its parameter \"where\".\nwget-1.19.5/src/url.c:1110:3: return_alloc: Returning allocated memory \"full_path\".\nwget-1.19.5/src/http.c:2431: var_assign: Assigning: \"pth\" = storage returned from \"url_full_path(u)\".\nwget-1.19.5/src/http.c:2446: noescape: Resource \"pth\" is not freed or pointed-to in \"create_authorization_line\".\nwget-1.19.5/src/http.c:5203:40: noescape: \"create_authorization_line(char const *, char const *, char const *, char const *, char const *, _Bool *, uerr_t *)\" does not free or save its parameter \"path\".\nwget-1.19.5/src/http.c:2476: leaked_storage: Variable \"pth\" going out of scope leaks the storage it points to.\n\\# 2474|                 /* Creating the Authorization header went wrong */\n\\# 2475|               }\n\\# 2476|->         }\n\\# 2477|         else\n\\# 2478|           {\n\nBoth \"pth\" and \"auth_stat\" are allocated in \"check_auth()\" function. These are used for creating the HTTP Authorization Request header via \"create_authorization_line()\" function. In case the creation went OK (auth_err == RETROK), then the memory previously allocated to \"pth\" and \"auth_stat\" is freed. However if the creation failed, then the memory is never freed and it leaks.\n\nSigned-off-by: Tomas Hozza <thozza@redhat.com>","distinct":true,"url":"https://api.github.com/repos/dstw/wget/commits/b8be904ac7c25387672b0aa39f7cba699bffc48e"},{"sha":"dfef92bac3997b9848e86d84a843d5d7dde4fd99","author":{"name":"Tomas Hozza","email":"2152b765a3a51268598a4503265cd77ce732fa8c@redhat.com"},"message":"* src/http.c (http_loop): Fix RESOURCE LEAK found by Coverity\n\nError: RESOURCE_LEAK (CWE-772):\nwget-1.19.5/src/http.c:4486: alloc_fn: Storage is returned from allocation function \"url_string\".\nwget-1.19.5/src/url.c:2248:3: alloc_fn: Storage is returned from allocation function \"xmalloc\".\nwget-1.19.5/lib/xmalloc.c:41:11: alloc_fn: Storage is returned from allocation function \"malloc\".\nwget-1.19.5/lib/xmalloc.c:41:11: var_assign: Assigning: \"p\" = \"malloc(n)\".\nwget-1.19.5/lib/xmalloc.c:44:3: return_alloc: Returning allocated memory \"p\".\nwget-1.19.5/src/url.c:2248:3: var_assign: Assigning: \"result\" = \"xmalloc(size)\".\nwget-1.19.5/src/url.c:2248:3: var_assign: Assigning: \"p\" = \"result\".\nwget-1.19.5/src/url.c:2250:3: noescape: Resource \"p\" is not freed or pointed-to in function \"memcpy\". [Note: The source code implementation of the function has been overridden by a builtin model.]\nwget-1.19.5/src/url.c:2253:7: noescape: Resource \"p\" is not freed or pointed-to in function \"memcpy\". [Note: The source code implementation of the function has been overridden by a builtin model.]\nwget-1.19.5/src/url.c:2257:11: noescape: Resource \"p\" is not freed or pointed-to in function \"memcpy\". [Note: The source code implementation of the function has been overridden by a builtin model.]\nwget-1.19.5/src/url.c:2264:3: noescape: Resource \"p\" is not freed or pointed-to in function \"memcpy\". [Note: The source code implementation of the function has been overridden by a builtin model.]\nwget-1.19.5/src/url.c:2270:7: identity_transfer: Passing \"p\" as argument 1 to function \"number_to_string\", which returns an offset off that argument.\nwget-1.19.5/src/utils.c:1776:11: var_assign_parm: Assigning: \"p\" = \"buffer\".\nwget-1.19.5/src/utils.c:1847:3: return_var: Returning \"p\", which is a copy of a parameter.\nwget-1.19.5/src/url.c:2270:7: noescape: Resource \"p\" is not freed or pointed-to in function \"number_to_string\".\nwget-1.19.5/src/utils.c:1774:25: noescape: \"number_to_string(char *, wgint)\" does not free or save its parameter \"buffer\".\nwget-1.19.5/src/url.c:2270:7: var_assign: Assigning: \"p\" = \"number_to_string(p, url->port)\".\nwget-1.19.5/src/url.c:2273:3: noescape: Resource \"p\" is not freed or pointed-to in function \"full_path_write\".\nwget-1.19.5/src/url.c:1078:47: noescape: \"full_path_write(struct url const *, char *)\" does not free or save its parameter \"where\".\nwget-1.19.5/src/url.c:2287:3: return_alloc: Returning allocated memory \"result\".\nwget-1.19.5/src/http.c:4486: var_assign: Assigning: \"hurl\" = storage returned from \"url_string(u, URL_AUTH_HIDE_PASSWD)\".\nwget-1.19.5/src/http.c:4487: noescape: Resource \"hurl\" is not freed or pointed-to in \"logprintf\".\nwget-1.19.5/src/http.c:4513: leaked_storage: Variable \"hurl\" going out of scope leaks the storage it points to.\n\\# 4511|               {\n\\# 4512|                 printwhat (count, opt.ntry);\n\\# 4513|->               continue;\n\\# 4514|               }\n\\# 4515|             else\n\nThere are two conditional branches, which call continue, without freeing memory potentially allocated and pointed to by\"hurl\" pointer. In fase \"!opt.verbose\" is True and some of the appropriate conditions in the following if/else if construction, in which \"continue\" is called, are also true, then the memory allocated to \"hurl\" will leak.\n\nSigned-off-by: Tomas Hozza <thozza@redhat.com>","distinct":true,"url":"https://api.github.com/repos/dstw/wget/commits/dfef92bac3997b9848e86d84a843d5d7dde4fd99"},{"sha":"c045cdded4e3850724d8bb3a655852948e62c0df","author":{"name":"Tomas Hozza","email":"2152b765a3a51268598a4503265cd77ce732fa8c@redhat.com"},"message":"* src/utils.c (open_stat): Fix RESOURCE LEAK found by Coverity\n\nError: RESOURCE_LEAK (CWE-772):\nwget-1.19.5/src/utils.c:914: open_fn: Returning handle opened by \"open\". [Note: The source code implementation of the function has been overridden by a user model.]\nwget-1.19.5/src/utils.c:914: var_assign: Assigning: \"fd\" = handle returned from \"open(fname, flags, mode)\".\nwget-1.19.5/src/utils.c:921: noescape: Resource \"fd\" is not freed or pointed-to in \"fstat\". [Note: The source code implementation of the function has been overridden by a builtin model.]\nwget-1.19.5/src/utils.c:924: leaked_handle: Handle variable \"fd\" going out of scope leaks the handle.\n\\#  922|     {\n\\#  923|       logprintf (LOG_NOTQUIET, _(\"Failed to stat file %s, error: %s\\n\"), fname, strerror(errno));\n\\#  924|->     return -1;\n\\#  925|     }\n\\#  926|   #if !(defined(WINDOWS) || defined(__VMS))\n\nThis seems to be a real issue, since the opened file descriptor in \"fd\"\nwould leak. There is also additional check below the \"fstat\" call, which\ncloses the opened \"fd\".\n\nSigned-off-by: Tomas Hozza <thozza@redhat.com>","distinct":true,"url":"https://api.github.com/repos/dstw/wget/commits/c045cdded4e3850724d8bb3a655852948e62c0df"},{"sha":"8b451f9f21cc1b00d1a08116b542fb7bd7589405","author":{"name":"Tomas Hozza","email":"2152b765a3a51268598a4503265cd77ce732fa8c@redhat.com"},"message":"* src/warc.c (warc_write_start_record): Fix potential RESOURCE LEAK\n\nIn warc_write_start_record() function, the reutrn value of dup() is\ndirectly used in gzdopen() call and not stored anywhere. However the\nzlib documentation says that \"The duplicated descriptor should be saved\nto avoid a leak, since gzdopen does not close fd if it fails.\" [1].\nThis change stores the FD in a variable and closes it in case gzopen()\nfails.\n\n[1] https://www.zlib.net/manual.html\n\nError: RESOURCE_LEAK (CWE-772):\nwget-1.19.5/src/warc.c:217: open_fn: Returning handle opened by \"dup\".\nwget-1.19.5/src/warc.c:217: leaked_handle: Failing to save or close handle opened by \"dup(fileno(warc_current_file))\" leaks it.\n\\#  215|\n\\#  216|         /* Start a new GZIP stream. */\n\\#  217|->       warc_current_gzfile = gzdopen (dup (fileno (warc_current_file)), \"wb9\");\n\\#  218|         warc_current_gzfile_uncompressed_size = 0;\n\\#  219|\n\nSigned-off-by: Tomas Hozza <thozza@redhat.com>","distinct":true,"url":"https://api.github.com/repos/dstw/wget/commits/8b451f9f21cc1b00d1a08116b542fb7bd7589405"},{"sha":"2f451dbf4e83c751f6bbba7ed26d90bf275fcbf7","author":{"name":"Tomas Hozza","email":"2152b765a3a51268598a4503265cd77ce732fa8c@redhat.com"},"message":"* src/warc.c (warc_write_cdx_record): Fix RESOURCE LEAK found by Coverity\n\nError: RESOURCE_LEAK (CWE-772): - REAL ERROR\nwget-1.19.5/src/warc.c:1376: alloc_fn: Storage is returned from allocation function \"url_escape\".\nwget-1.19.5/src/url.c:284:3: alloc_fn: Storage is returned from allocation function \"url_escape_1\".\nwget-1.19.5/src/url.c:255:3: alloc_fn: Storage is returned from allocation function \"xmalloc\".\nwget-1.19.5/lib/xmalloc.c:41:11: alloc_fn: Storage is returned from allocation function \"malloc\".\nwget-1.19.5/lib/xmalloc.c:41:11: var_assign: Assigning: \"p\" = \"malloc(n)\".\nwget-1.19.5/lib/xmalloc.c:44:3: return_alloc: Returning allocated memory \"p\".\nwget-1.19.5/src/url.c:255:3: var_assign: Assigning: \"newstr\" = \"xmalloc(newlen + 1)\".\nwget-1.19.5/src/url.c:258:3: var_assign: Assigning: \"p2\" = \"newstr\".\nwget-1.19.5/src/url.c:275:3: return_alloc: Returning allocated memory \"newstr\".\nwget-1.19.5/src/url.c:284:3: return_alloc_fn: Directly returning storage allocated by \"url_escape_1\".\nwget-1.19.5/src/warc.c:1376: var_assign: Assigning: \"redirect_location\" = storage returned from \"url_escape(redirect_location)\".\nwget-1.19.5/src/warc.c:1381: noescape: Resource \"redirect_location\" is not freed or pointed-to in \"fprintf\".\nwget-1.19.5/src/warc.c:1387: leaked_storage: Returning without freeing \"redirect_location\" leaks the storage that it points to.\n\\# 1385|     fflush (warc_current_cdx_file);\n\\# 1386|\n\\# 1387|->   return true;\n\\# 1388|   }\n\\# 1389|\n\nurl_escape() really returns a newly allocated memory and it leaks when the warc_write_cdx_record() returns. The memory returned from url_escape() is usually stored in a temporary variable in other parts of the project and then freed. I took the same approach.\n\nSigned-off-by: Tomas Hozza <thozza@redhat.com>","distinct":true,"url":"https://api.github.com/repos/dstw/wget/commits/2f451dbf4e83c751f6bbba7ed26d90bf275fcbf7"}]}
{"actor":{"display_login":"dstw"}}