[CWE-401] Possible leak de malloc

[darnuria]

Avec l'ajout de l'option merveilleuse de compilation de GCC en version 10 -fanalyzer qui fait de l'ascii art ET de l'analyse statique, article a propos de cet option ici: https://developers.redhat.com/blog/2020/03/26/static-analysis-in-gcc-10/

Ping: @p4bl0- c'est une potentiel CWE donc je te ping ça fait un bon cas ses trois issues si tu veux faire un "point la securité vous touche aussi ici avec nous". ;p

En ajoutant l'option je suis tombé sur un leak sur malloc un-e étudiant-e motivé de L2 ou L3 c'est possible sinon M1.

Comment reproduire dans [configure.ac] changer la ligne suivante configure.ac#L56

-CFLAGS="-Wall -O3"
+CFLAGS="-Wall -Wextra -fanalyzer -O3"

Relancer les autotools: make -f Makefile.autotools
Puis compiler make -j4

Le problème en brut:

GL4D/fixed_heap.c: In function ‘_newheap’:
GL4D/fixed_heap.c:125:13: warning: leak of ‘<unknown>’ [CWE-401] [-Wanalyzer-malloc-leak]
  125 |   h.stack = malloc(nmem * sizeof *(h.stack));
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ‘fheapCreate’: events 1-4
    |
    |   34 | size_t fheapCreate(size_t nmem, size_t size) {
    |      |        ^~~~~~~~~~~
    |      |        |
    |      |        (1) entry to ‘fheapCreate’
    |......
    |   38 |   if(_heap.heap == NULL) {
    |      |     ~   
    |      |     |
    |      |     (2) following ‘true’ branch...
    |   39 |     _heap = _newheap(_heap.nmem, _heap.size);
    |      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |             |
    |      |             (3) ...to here
    |      |             (4) calling ‘_newheap’ from ‘fheapCreate’
    |
    +--> ‘_newheap’: events 5-6
           |
           |  118 | static fheap_t _newheap(size_t nmem, size_t size) {
           |      |                ^~~~~~~~
           |      |                |
           |      |                (5) entry to ‘_newheap’
           |......
           |  123 |   h.heap = calloc(nmem, size * sizeof *(h.heap));
           |      |            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |            |
           |      |            (6) allocated here
           |
         ‘_newheap’: event 7
           |
           |  124 |   assert(h.heap);
           |      |   ^~~~~~
           |      |   |
           |      |   (7) assuming ‘<unknown>’ is non-NULL
           |
         ‘_newheap’: event 8
           |
           |
         ‘_newheap’: event 9
           |
           |  125 |   h.stack = malloc(nmem * sizeof *(h.stack));
           |      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |             |
           |      |             (9) ...to here
           |
         ‘_newheap’: event 10
           |
           |  126 |   assert(h.stack);
           |      |   ^~~~~~
           |      |   |
           |      |   (10) following ‘true’ branch...
           |
         ‘_newheap’: event 11
           |
           |cc1:
           | (11): ...to here
           |
         ‘_newheap’: events 12-14
           |
           |  125 |   h.stack = malloc(nmem * sizeof *(h.stack));
           |      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |             |
           |      |             (14) ‘<unknown>’ leaks here; was allocated at (6)
           |......
           |  128 |   for(i = 0; i < nmem; ++i)
           |      |   ^~~
           |      |   |
           |      |   (12) following ‘false’ branch (when ‘i >= nmem’)...
           |  129 |     _push(h.stack, &(h.head), nmem - 1 - i);
           |  130 |   return h;
           |      |          ~
           |      |          |
           |      |          (13) ...to here
           |