Re: [LTP] LTP/Lite test float_trigo core dumps due to free(): invalid pointer

[linuxtestproject.agent@gmail.com]

Hi Tomas,

On Thu, 09 Jul 2026 17:40:04 +0200, Tomas Dzik wrote:
> LTP/Lite test float_trigo core dumps due to free(): invalid pointer

--- [PATCH 1/3] ---

> If malloc() inside function read_file() fails and return value is
> not checked, the current code runs free() on uninitialized pointer.

The return value of read_file() is checked by thread_code() via
`if (fsize == (size_t) 0)`. Is the description perhaps trying to say
that read_file() does not initialize *data on failure paths, so the
caller ends up calling SAFE_FREE() on an uninitialized pointer?

The fix itself is correct -- initializing din and dex to NULL ensures
SAFE_FREE() is a no-op on the error path.

--- [PATCH 3/3] ---

> -	sprintf(funct, "%s/gensinh", bin_path);
> +	snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
> +		"%s/gensinh", bin_path);
>  	child = create_file(funct, 0);
>  	waitpid(child, NULL, 0);
>
>  	sprintf(funct, "%s/gentanh", bin_path);
> +	snprintf(funct, strlen(bin_path) + MAX_FNAME_LEN,
> +		"%s/gentanh", bin_path);

The sprintf() line for "gentanh" in geniperb.c was not removed. Both
calls are present in the result: the old sprintf() writes the path,
then the new snprintf() overwrites it with the same value, and
create_file() runs once. Functionally identical, but the unreplaced
sprintf() is the exact call this patch is meant to eliminate.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp