[PATCH] *** Fixed issues/defects reported by Coverity tool ***

[PATCH] *** Fixed issues/defects reported by Coverity tool ***

[sudarshan.bisht]

From: Sudarshan <sudarshan.bisht@nokia.com>

	Coverity Static Analysis helps developers find hard-to-spot,
yet potentially crash-causing defects early in the development phase,
reducing the cost,time, and risk of software errors.
	This patch has a fix for conditions where 1) variable is used 
evern after getting freed thus causing junk assignment and 2) double 
free of memory.

Sudarshan (1):
  alsa-lib: fixed coverity reported issues under "USE_AFTER_FREE"
    checker.

 src/control/control_hw.c |    1 +
 src/mixer/mixer.c        |    2 +-
 2 files changed, 2 insertions(+), 1 deletions(-)

[PATCH] alsa-lib: fixed coverity reported issues under "USE_AFTER_FREE" checker.

[sudarshan.bisht]

From: Sudarshan <sudarshan.bisht@nokia.com>

---
 src/control/control_hw.c |    1 +
 src/mixer/mixer.c        |    2 +-
 2 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/src/control/control_hw.c b/src/control/control_hw.c
index cf258b4..a8463c1 100644
--- a/src/control/control_hw.c
+++ b/src/control/control_hw.c
@@ -414,6 +414,7 @@ int snd_ctl_hw_open(snd_ctl_t **handle, const char *name, int card, int mode)
 	if (err < 0) {
 		close(fd);
 		free(hw);
+		hw = NULL;
 	}
 	ctl->ops = &snd_ctl_hw_ops;
 	ctl->private_data = hw;
diff --git a/src/mixer/mixer.c b/src/mixer/mixer.c
index 85d843f..0f4f1ac 100644
--- a/src/mixer/mixer.c
+++ b/src/mixer/mixer.c
@@ -205,7 +205,7 @@ int snd_mixer_attach(snd_mixer_t *mixer, const char *name)
 		return err;
 	err = snd_mixer_attach_hctl(mixer, hctl);
 	if (err < 0) {
-		snd_hctl_close(hctl);
+		/* ideally hctl should be freed here, but it's taken care in snd_mixer_attach_hctl*/	
 		return err;
 	}
 	return 0;
-- 
1.7.0.4

Re: [PATCH] alsa-lib: fixed coverity reported issues under "USE_AFTER_FREE" checker.

[Clemens Ladisch]

sudarshan.bisht@nokia.com wrote:
> --- a/src/control/control_hw.c
> +++ b/src/control/control_hw.c
> @@ -414,6 +414,7 @@ int snd_ctl_hw_open(snd_ctl_t **handle, const char *name, int card, int mode)
>  	if (err < 0) {
>  		close(fd);
>  		free(hw);
> +		hw = NULL;
>  	}

In this place, it's just a "return err" that is missing.

> --- a/src/mixer/mixer.c
> +++ b/src/mixer/mixer.c
> @@ -205,7 +205,7 @@ int snd_mixer_attach(snd_mixer_t *mixer, const char *name)
>  		return err;
>  	err = snd_mixer_attach_hctl(mixer, hctl);
>  	if (err < 0) {
> -		snd_hctl_close(hctl);
> +		/* ideally hctl should be freed here, but it's taken care in snd_mixer_attach_hctl*/	
>  		return err;
>  	}

If the calloc() in snd_mixer_attach_hctl() fails, hctl is not freed.
The bug is the inconsistent error handling cleanup in
snd_mixer_attach_hctl(); I think it shouldn't free its hctl in any case.


Regards,
Clemens

Re: [PATCH] alsa-lib: fixed coverity reported issues under "USE_AFTER_FREE" checker.

[Sudarshan Bisht]

On Thu, 2011-03-17 at 12:22 +0100, ext Clemens Ladisch wrote:
> sudarshan.bisht@nokia.com wrote:
> > --- a/src/control/control_hw.c
> > +++ b/src/control/control_hw.c
> > @@ -414,6 +414,7 @@ int snd_ctl_hw_open(snd_ctl_t **handle, const char *name, int card, int mode)
> >  	if (err < 0) {
> >  		close(fd);
> >  		free(hw);
> > +		hw = NULL;
> >  	}
> 
> In this place, it's just a "return err" that is missing.
Ok.
> 
> > --- a/src/mixer/mixer.c
> > +++ b/src/mixer/mixer.c
> > @@ -205,7 +205,7 @@ int snd_mixer_attach(snd_mixer_t *mixer, const char *name)
> >  		return err;
> >  	err = snd_mixer_attach_hctl(mixer, hctl);
> >  	if (err < 0) {
> > -		snd_hctl_close(hctl);
> > +		/* ideally hctl should be freed here, but it's taken care in snd_mixer_attach_hctl*/	
> >  		return err;
> >  	}
> 
> If the calloc() in snd_mixer_attach_hctl() fails, hctl is not freed.
> The bug is the inconsistent error handling cleanup in
> snd_mixer_attach_hctl(); I think it shouldn't free its hctl in any case.
Ok, I will remove freeing of hctl from snd_mixer_attach_hctl().
> 
> 
> Regards,
> Clemens


Br,
Sudarshan Bisht

[PATCH] alsa-lib: fixed coverity reported issues under "USE_AFTER_FREE" checker.

[sudarshan.bisht]

From: Sudarshan <sudarshan.bisht@nokia.com>

---
 modules/mixer/simple/python.c |    1 +
 src/control/control_hw.c      |    1 +
 src/mixer/mixer.c             |    1 -
 src/mixer/simple_abst.c       |    2 ++
 4 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/modules/mixer/simple/python.c b/modules/mixer/simple/python.c
index c822c52..784d9a0 100644
--- a/modules/mixer/simple/python.c
+++ b/modules/mixer/simple/python.c
@@ -663,6 +663,7 @@ pymixer_attach_hctl(struct pymixer *pymixer, PyObject *args)
 		return NULL;
 	err = snd_mixer_attach_hctl(pymixer->mixer, hctl);
 	if (err < 0) {
+		snd_hctl_close(hctl);
 		PyErr_Format(PyExc_RuntimeError, "Cannot attach hctl: %s", snd_strerror(err));
 		return NULL;
 	}
diff --git a/src/control/control_hw.c b/src/control/control_hw.c
index cf258b4..16c4987 100644
--- a/src/control/control_hw.c
+++ b/src/control/control_hw.c
@@ -414,6 +414,7 @@ int snd_ctl_hw_open(snd_ctl_t **handle, const char *name, int card, int mode)
 	if (err < 0) {
 		close(fd);
 		free(hw);
+		return err;
 	}
 	ctl->ops = &snd_ctl_hw_ops;
 	ctl->private_data = hw;
diff --git a/src/mixer/mixer.c b/src/mixer/mixer.c
index 85d843f..5e5789a 100644
--- a/src/mixer/mixer.c
+++ b/src/mixer/mixer.c
@@ -228,7 +228,6 @@ int snd_mixer_attach_hctl(snd_mixer_t *mixer, snd_hctl_t *hctl)
 		return -ENOMEM;
 	err = snd_hctl_nonblock(hctl, 1);
 	if (err < 0) {
-		snd_hctl_close(hctl);
 		free(slave);
 		return err;
 	}
diff --git a/src/mixer/simple_abst.c b/src/mixer/simple_abst.c
index 9e9aaf5..127d8d2 100644
--- a/src/mixer/simple_abst.c
+++ b/src/mixer/simple_abst.c
@@ -336,6 +336,8 @@ int snd_mixer_simple_basic_register(snd_mixer_t *mixer,
 		err = find_module(class, top);
 	if (err >= 0)
 		err = snd_mixer_attach_hctl(mixer, priv->hctl);
+		if(err < 0) 
+			 goto __error;		
 	if (err >= 0) {
 		priv->attach_flag = 1;
 		err = snd_mixer_class_register(class, mixer);
-- 
1.7.0.4