[PATCH BlueZ v1] gatt-server: fix memory leak in bt_gatt_server_send_notification()

[PATCH BlueZ v1] gatt-server: fix memory leak in bt_gatt_server_send_notification()

[Roman Smirnov]

data-pdu is allocated but not released when an error occurs.

Add data-pdu release before exiting the function in case of an error.

Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.
---
 src/shared/gatt-server.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c
index 0e399ceb1..fb8819c70 100644
--- a/src/shared/gatt-server.c
+++ b/src/shared/gatt-server.c
@@ -1822,6 +1822,7 @@ bool bt_gatt_server_send_notification(struct bt_gatt_server *server,
 	return result;
 
 error:
+	free(data->pdu);
 	if (data)
 		free(data);
 
-- 
2.43.0

RE: [BlueZ,v1] gatt-server: fix memory leak in bt_gatt_server_send_notification()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1707 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=866206

---Test result---

Test Summary:
CheckPatch                    PASS      0.44 seconds
GitLint                       PASS      0.33 seconds
BuildEll                      PASS      24.60 seconds
BluezMake                     PASS      1669.13 seconds
MakeCheck                     PASS      13.04 seconds
MakeDistcheck                 PASS      177.63 seconds
CheckValgrind                 PASS      252.82 seconds
CheckSmatch                   WARNING   353.79 seconds
bluezmakeextell               PASS      120.50 seconds
IncrementalBuild              PASS      1414.90 seconds
ScanBuild                     PASS      1002.35 seconds

Details
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
src/shared/gatt-server.c:278:25: warning: Variable length array is used.src/shared/gatt-server.c:621:25: warning: Variable length array is used.src/shared/gatt-server.c:720:25: warning: Variable length array is used.src/shared/gatt-server.c:278:25: warning: Variable length array is used.src/shared/gatt-server.c:621:25: warning: Variable length array is used.src/shared/gatt-server.c:720:25: warning: Variable length array is used.src/shared/gatt-server.c:278:25: warning: Variable length array is used.src/shared/gatt-server.c:621:25: warning: Variable length array is used.src/shared/gatt-server.c:720:25: warning: Variable length array is used.


---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v1] gatt-server: fix memory leak in bt_gatt_server_send_notification()

[Luiz Augusto von Dentz]

Hi Roman,

On Thu, Jun 27, 2024 at 11:11 AM Roman Smirnov <r.smirnov@omp.ru> wrote:
>
> data-pdu is allocated but not released when an error occurs.
>
> Add data-pdu release before exiting the function in case of an error.
>
> Found by Linux Verification Center (linuxtesting.org) with the SVACE
> static analysis tool.
> ---
>  src/shared/gatt-server.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c
> index 0e399ceb1..fb8819c70 100644
> --- a/src/shared/gatt-server.c
> +++ b/src/shared/gatt-server.c
> @@ -1822,6 +1822,7 @@ bool bt_gatt_server_send_notification(struct bt_gatt_server *server,
>         return result;
>
>  error:
> +       free(data->pdu);
>         if (data)
>                 free(data);

This should probably be inside if (data) block though.

>
> --
> 2.43.0
>
>


-- 
Luiz Augusto von Dentz