Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-35578

libuser: Fix findings from static application security testing (SAST)

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Undefined Undefined
    • rhel-8.10.z
    • rhel-8.0.0
    • libuser
    • None
    • libuser-0.62-26.el8_10
    • None
    • None
    • rhel-sst-idm-sssd
    • ssg_idm
    • 2
    • QE ack, Dev ack
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None

      Valid finding from SAST:

      1.

      "Error: RESOURCE_LEAK (CWE-772):
      libuser-0.63/lib/user.c:931: alloc_fn: Storage is returned from allocation function ""lu_ent_new"".
      libuser-0.63/lib/user.c:931: var_assign: Assigning: ""tmp"" = storage returned from ""lu_ent_new()"".
      libuser-0.63/lib/user.c:989: leaked_storage: Variable ""tmp"" going out of scope leaks the storage it points to.
      #  987|       case group_default:
      #  988|           /* Make sure we have both name and boolean here. */
      #  989|->         g_return_val_if_fail(sdata != NULL, FALSE);
      #  990|           /* Run the checks and preps. */
      #  991|           if (run_list(context, context->create_module_names,"
      

      2.

      "Error: RESOURCE_LEAK (CWE-772):
      libuser-0.63/lib/user.c:931: alloc_fn: Storage is returned from allocation function ""lu_ent_new"".
      libuser-0.63/lib/user.c:931: var_assign: Assigning: ""tmp"" = storage returned from ""lu_ent_new()"".
      libuser-0.63/lib/user.c:1097: leaked_storage: Variable ""tmp"" going out of scope leaks the storage it points to.
      # 1095|       case groups_enumerate_by_user:
      # 1096|           /* Make sure we have both name and ID here. */
      # 1097|->         g_return_val_if_fail(sdata != NULL, FALSE);
      # 1098|           if (id == users_enumerate_by_group)
      # 1099|               ldata = convert_group_name_to_id(context, sdata,"
      

      3.

      "Error: RESOURCE_LEAK (CWE-772):
      libuser-0.63/lib/user.c:931: alloc_fn: Storage is returned from allocation function ""lu_ent_new"".
      libuser-0.63/lib/user.c:931: var_assign: Assigning: ""tmp"" = storage returned from ""lu_ent_new()"".
      libuser-0.63/lib/user.c:1068: leaked_storage: Variable ""tmp"" going out of scope leaks the storage it points to.
      # 1066|   	case group_setpass:
      # 1067|   		/* Make sure we have a valid password. */
      # 1068|-> 		g_return_val_if_fail(sdata != NULL, FALSE);
      # 1069|   		/* no break: fall through */
      # 1070|   	case user_removepass:"
      

              mhlavink Michal Hlavinka
              thalman@redhat.com Tomas Halman
              Tomas Halman Tomas Halman
              Shridhar Gadekar Shridhar Gadekar
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: