Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-5040-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: Bastien Nocera <hadess@hadess.net>
To: linux-bluetooth@vger.kernel.org
Cc: Bastien Nocera <hadess@hadess.net>
Subject: [BlueZ 8/9] bap: Fix more memory leaks on error
Date: Thu, 30 May 2024 16:58:02 +0200
Message-ID: <20240530150057.444585-9-hadess@hadess.net>
In-Reply-To: <20240530150057.444585-1-hadess@hadess.net>
References: <20240530150057.444585-1-hadess@hadess.net>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Error: RESOURCE_LEAK (CWE-772): [#def32] [important]
bluez-5.76/profiles/audio/bap.c:1166:4: alloc_arg: "asprintf" allocates memory that is stored into "path". [Note: The source code implementation of the function has been overridden by a builtin model.]
bluez-5.76/profiles/audio/bap.c:1178:5: leaked_storage: Variable "path" going out of scope leaks the storage it points to.
1176|					free(l3_caps);
1177|					ret = false;
1178|->					goto group_fail;
1179|				}
1180|

Error: RESOURCE_LEAK (CWE-772): [#def33] [important]
bluez-5.76/profiles/audio/bap.c:1166:4: alloc_arg: "asprintf" allocates memory that is stored into "path". [Note: The source code implementation of the function has been overridden by a builtin model.]
bluez-5.76/profiles/audio/bap.c:1199:5: leaked_storage: Variable "path" going out of scope leaks the storage it points to.
1197|
1198|				if (matched_lpac == NULL || merged_caps == NULL)
1199|->					continue;
1200|
1201|				create_stream_for_bis(bap_data, matched_lpac, qos,
---
 profiles/audio/bap.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c
index 3fcf21df58aa..53e7b3e34378 100644
--- a/profiles/audio/bap.c
+++ b/profiles/audio/bap.c
@@ -1174,6 +1174,7 @@ static bool parse_base(struct bap_data *bap_data, struct bt_iso_base *base,
 			if (!util_iov_pull_u8(&iov,
 						(void *)&l3_caps->iov_len)) {
 				free(l3_caps);
+				free(path);
 				ret = false;
 				goto group_fail;
 			}
@@ -1195,8 +1196,10 @@ static bool parse_base(struct bap_data *bap_data, struct bt_iso_base *base,
 					l2_caps, l3_caps, &matched_lpac,
 					&merged_caps);
 
-			if (matched_lpac == NULL || merged_caps == NULL)
+			if (matched_lpac == NULL || merged_caps == NULL) {
+				free(path);
 				continue;
+			}
 
 			create_stream_for_bis(bap_data, matched_lpac, qos,
 					merged_caps, meta, path);
-- 
2.45.1