Fix misc bugs/leaks - #215
Open
jschueller wants to merge 3 commits into
Open
Conversation
- XML: Fix XML parser handle leak on file/read/parse errors; fix null deref after calloc in fmi1_parser; fix callbacks-vs-cb null deref in terminals_and_icons; fix skip_space consuming all chars (|| vs &&); fix NOT FALSE evaluating as FALSE (duplicate condition); fix assert(0) reaching use-after-free in release builds; fix ptr-to-enum comparison in independent variable type check; add XML_StopParser NULL guards; fix parse buffer null deref - CAPI: Fix unchecked fmi_util_allocate_options return (null deref on load); fix missing null guards in fmi1_capi_free_model_instance - Import: Fix instanceName memory leaks on error paths in fmi3_import_capi; fix buffer overflow in fmi2_import (strcpy without capacity check); fix missing message in fmi3_default_callback_logger; fix null derefs in variable_list join functions - ZIP: Fix null callbacks crash in unzip/zip; fix zipClose(NULL) in minizip; fix unzCloseCurrentFile on unopened file; replace exit(-1) with return - Util: Fix dlerror NULL passed to %s (UB); fix allocator mismatch (free vs cb->free); fix tmpPath leak on mkdtemp failure; fix string_set corruption on malloc failure; fix unterminated buffer in enum to-string; replace sprintf with jm_snprintf
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Memory Leaks Fixed (4)
fmi_xml_context.c— XML parser handle leaked onfopen/read/parse errors (addedfmi_xml_free_contextbefore returns)fmi3_import_capi.c—instanceNameleaked on 6 error paths in 3 instantiation functions (free + NULL before return)jm_portability.c:302—tmpPathleaked onmkdtempfailure (free + NULL return)jm_string_set.h:109— Onmallocfailure after vector insert, string set was corrupted (allocate before insert)Null Pointer Dereferences / Crashes Fixed (9)
fmi1_xml_parser.c:593— Addedreturn -1aftercallocfailurefmi_xml_terminals_and_icons.c:27— Usedcb->callocinstead ofcallbacks->calloc(NULL parameter)fmi1/fmi3_xml_parser_util.c— Addedif (context->parser)guard onXML_StopParserfmi_xml_context.c:73— SameXML_StopParserNULL guardfmi1/fmi3_xml_parser.c— Checkfmi*_xml_reserve_parse_bufferreturn before dereferenceCAPI fmi1/fmi2/fmi3_capi.c— Checkfmi_util_allocate_optionsreturn for NULLfmi1_capi_me.c— Addedfmu != NULL && fmu->c != NULLguards, nullify after freeZIP fmi_zip_unzip.c,fmi_zip_zip.c— Addedif (!callbacks) callbacks = jm_get_default_callbacks()ZIP fmi_minizip.c:386—zipClose(NULL)guarded with ternary checkLogic Bugs Fixed (6)
fmi1/fmi2_xml_query.c:58—while(curCh || ...)→while(curCh && (...))inskip_space(was consuming all characters)fmi1/fmi2_xml_query.c:269— Duplicatekind==TRUEcheck →kind==FALSE(NOT FALSE was incorrectly FALSE)fmi2_xml_variable.c:459—variable->type != fmi2_base_type_real(pointer-to-enum comparing against NULL) → proper base type check with NULL guardfmi1_xml_variable.c:1255—assert(0)→return -1(use-after-free in release builds)fmi_miniunz.c:359— RemovedunzCloseCurrentFile(uf)when file was never successfully openedfmi_miniunz.c:448—exit(-1)→return 1Memory / Resource Safety (6)
jm_portability.c:114—dlerror()NULL →%sis UB (added NULL check with fallback)jm_portability.c:457—free()→cb->free()(allocator mismatch)jm_portability.c:216—sprintf→jm_snprintffmi2_enums.c:294,fmi3_enums.c:368— Non-null-terminated buffer on edge case (bufSize > 0check + force null terminate)fmi2_import.c:115—strcpywith unchecked remaining capacity (added capacity check beforestrcpy)fmi3_import_convenience.c:356— Missing message in default callback logger (addedmessageto fprintf)Null Pointer Defenses (3)
fmi1/fmi2/fmi3_import_variable_list.c— Addedif (!a) return 0guard beforea->fmudereference injoin_var_listfmi1_xml_cosim.c— Reverted bad edit that changed memcpy source to NULL (restored original code)