From 477c48dc1ae7a3eb32f03f24b315e978d312c93d Mon Sep 17 00:00:00 2001 From: usi096 Date: Wed, 10 Dec 2025 14:27:31 +0000 Subject: [PATCH] RDKB-62690 Revert "RDKB-62302, RDKB-62102: [Coverity] High impact Coverity bugs - ccsp-common-library (#39)" This reverts commit f9ade97e3f6a581d669fe72d6c25d14d50e009dd. --- .../CCSP_AliasMgr/ccsp_alias_mgr_base.c | 2 +- .../DslhWmpDatabase/dslh_wmpdo_mpaif.c | 29 +---- .../PoamIrepFolder/poam_irepfo_access.c | 1 - .../Bmc2ReqController/bmc2_reqco_control.c | 8 +- .../package/slap/include/slap_definitions.h | 5 +- .../slap/include/slap_vho_exported_api.h | 3 +- .../package/slap/include/slap_vho_interface.h | 3 +- .../slap_dslh_paramto_access.c | 110 ++---------------- .../bsp_eng/bspeng_archive_co_process.c | 14 +-- source/dm_pack/dm_pack_xml_helper.c | 109 ++++------------- .../SlapScoStandard/slap_scostd_operation.c | 33 ++++-- .../components/SlapVarHelper/slap_vho_plist.c | 13 +-- 12 files changed, 80 insertions(+), 250 deletions(-) diff --git a/source/ccsp/components/CCSP_AliasMgr/ccsp_alias_mgr_base.c b/source/ccsp/components/CCSP_AliasMgr/ccsp_alias_mgr_base.c index fe6c834bf..b7afef4b0 100644 --- a/source/ccsp/components/CCSP_AliasMgr/ccsp_alias_mgr_base.c +++ b/source/ccsp/components/CCSP_AliasMgr/ccsp_alias_mgr_base.c @@ -576,7 +576,7 @@ CcspAliasMgrFindMakeNode if ( !pChildNode ) { AnscTcFree((ANSC_HANDLE)pNsTokenChain); - pNsTokenChain = NULL; /*CID: 154673 fix for Use after free*/ + CcspTraceError(("TR-069 alias mapper - failed to allocate child node %s\n", Name)); break; diff --git a/source/ccsp/components/common/DataModel/dml/components/DslhWmpDatabase/dslh_wmpdo_mpaif.c b/source/ccsp/components/common/DataModel/dml/components/DslhWmpDatabase/dslh_wmpdo_mpaif.c index 33d0e4274..ea547901b 100644 --- a/source/ccsp/components/common/DataModel/dml/components/DslhWmpDatabase/dslh_wmpdo_mpaif.c +++ b/source/ccsp/components/common/DataModel/dml/components/DslhWmpDatabase/dslh_wmpdo_mpaif.c @@ -884,11 +884,8 @@ DslhWmpdoMpaSetParameterValues while (g_isBusy && count > 0) { CcspTraceWarning(("<< %s, It's g_isBusy busy try again in 250ms>>\n",__FUNCTION__)); - /*CID: 257711 fix for Waiting while holding a lock*/ - AnscReleaseTsLock(&pMyObject->AccessTsLock); usleep(250000); count --; - AnscAcquireTsLock(&pMyObject->AccessTsLock); } pthread_mutex_lock(&NotifyMutex); @@ -900,15 +897,10 @@ DslhWmpdoMpaSetParameterValues *ppInvalidParameterName = AnscCloneString(pParameterValueArray[i].Name); returnStatus = CCSP_ERR_INVALID_PARAMETER_VALUE; pthread_mutex_unlock(&NotifyMutex); - /*CID: 72271 fix for Resource leak*/ - if(vcSig.newValue) - AnscFreeMemory((char*)vcSig.newValue); - if(vcSig.oldValue) - AnscFreeMemory((char*)vcSig.oldValue); break; } /*sensitive information like keyPassphrase should not print*/ - if(_ansc_strstr(str,"KeyPassphrase") == NULL) /*CID: 66607 fix for Array compared against 0*/ + if((str != NULL) && (_ansc_strstr(str,"KeyPassphrase") == NULL)) { CcspTraceWarning(("<< %s sending Notification str %s >>\n",__FUNCTION__,str)); } @@ -960,14 +952,9 @@ DslhWmpdoMpaSetParameterValues { /* init the variable and object record arrays; */ pMyObject->InitObjVarArray(hThisObject); - } - /*CID: 272608 fix for Dereference after null check*/ - pObjRecordArray = (PDSLH_OBJ_RECORD_OBJECT* )pMyObject->hObjRecordArray; - pVarRecordArray = (PDSLH_VAR_RECORD_OBJECT* )pMyObject->hVarRecordArray; - if ( !pVarRecordArray || !pObjRecordArray ) - { - goto EXIT2; + pObjRecordArray = (PDSLH_OBJ_RECORD_OBJECT* )pMyObject->hObjRecordArray; + pVarRecordArray = (PDSLH_VAR_RECORD_OBJECT* )pMyObject->hVarRecordArray; } ulParameterCount = @@ -1001,14 +988,8 @@ DslhWmpdoMpaSetParameterValues for ( i = 0; i < ulObjectCount; i++ ) { pObjRecord = (PDSLH_OBJ_RECORD_OBJECT)pObjRecordArray[i]; - /*CID: 272608 fix for Dereference after null check*/ - if ( !pObjRecord ) - { - /* - * Impossible, no need for error handling... - */ - } - else + + if ( pObjRecord != NULL) { if ( !pObjRecord->VerifyChanges((ANSC_HANDLE)pObjRecord, &pFaultParamName) ) { diff --git a/source/ccsp/components/common/PoamIrepFolder/poam_irepfo_access.c b/source/ccsp/components/common/PoamIrepFolder/poam_irepfo_access.c index 56389f16e..5b8b8985b 100644 --- a/source/ccsp/components/common/PoamIrepFolder/poam_irepfo_access.c +++ b/source/ccsp/components/common/PoamIrepFolder/poam_irepfo_access.c @@ -279,7 +279,6 @@ PoamIrepFoGetFolderByIndex if(rc < EOK) { ERR_CHK(rc); - AnscFreeMemory(pName); /*CID: 186266 fix for Resource leak*/ return NULL; } diff --git a/source/cosa/package/bmc2/components/Bmc2ReqController/bmc2_reqco_control.c b/source/cosa/package/bmc2/components/Bmc2ReqController/bmc2_reqco_control.c index afe494393..144854867 100644 --- a/source/cosa/package/bmc2/components/Bmc2ReqController/bmc2_reqco_control.c +++ b/source/cosa/package/bmc2/components/Bmc2ReqController/bmc2_reqco_control.c @@ -262,9 +262,9 @@ Bmc2ReqcoDoTransfer if ( param_list ) { - /*CID: 164053 and 186730 Resource leak- Free the memory in SlapVhoCloneParamList */ + /*CID: 164053 Resource leak- Free the memory in SlapVhoCloneParamList */ /* SlapVhoCloneParamList allocates memory that is stored into dst_param_list*/ - SlapCloneParamList(param_list, pAsyncJob->ParamList, TRUE); + SlapCloneParamList(param_list, pAsyncJob->ParamList); } AnscSpawnTask @@ -337,9 +337,9 @@ Bmc2ReqcoDoExecute if ( param_list ) { - /*CID: 164052 and 186730 Resource leak - Free the ptr in SlapVhoCloneParamList */ + /*CID: 164052 Resource leak - Free the ptr in SlapVhoCloneParamList */ /* SlapVhoCloneParamList allocates memory that is stored into dst_param_list*/ - SlapCloneParamList(param_list, pAsyncJob->ParamList, TRUE); + SlapCloneParamList(param_list, pAsyncJob->ParamList); } AnscSpawnTask diff --git a/source/cosa/package/slap/include/slap_definitions.h b/source/cosa/package/slap/include/slap_definitions.h index 77372010b..3bb9b342e 100644 --- a/source/cosa/package/slap/include/slap_definitions.h +++ b/source/cosa/package/slap/include/slap_definitions.h @@ -712,11 +712,10 @@ SLAP_PARAMETER_LIST, *PSLAP_PARAMETER_LIST; SlapVhoInitParamList((ANSC_HANDLE)NULL, tbi_list); \ } -/*CID: 164052 and 186730 Resource leak - Free the ptr in SlapVhoCloneParamList */ -#define SlapCloneParamList(src_list, dst_list, free_dst_list) \ +#define SlapCloneParamList(src_list, dst_list) \ { \ ANSC_HANDLE dst_param_list = (ANSC_HANDLE)dst_list; \ - SlapVhoCloneParamList((ANSC_HANDLE)NULL, src_list, &dst_param_list, free_dst_list); \ + SlapVhoCloneParamList((ANSC_HANDLE)NULL, src_list, &dst_param_list); \ } #define SlapCleanParamList(tbc_list) \ diff --git a/source/cosa/package/slap/include/slap_vho_exported_api.h b/source/cosa/package/slap/include/slap_vho_exported_api.h index f86c3e1a9..b07e435d3 100644 --- a/source/cosa/package/slap/include/slap_vho_exported_api.h +++ b/source/cosa/package/slap/include/slap_vho_exported_api.h @@ -438,8 +438,7 @@ SlapVhoCloneParamList ( ANSC_HANDLE hThisObject, ANSC_HANDLE src_param_list, - ANSC_HANDLE* dst_param_list, - BOOL free_dst_list + ANSC_HANDLE* dst_param_list ); void diff --git a/source/cosa/package/slap/include/slap_vho_interface.h b/source/cosa/package/slap/include/slap_vho_interface.h index a067c8cde..0123c7f9f 100644 --- a/source/cosa/package/slap/include/slap_vho_interface.h +++ b/source/cosa/package/slap/include/slap_vho_interface.h @@ -285,8 +285,7 @@ typedef void ( ANSC_HANDLE hThisObject, ANSC_HANDLE src_param_list, - ANSC_HANDLE* dst_param_list, - BOOL free_dst_list + ANSC_HANDLE* dst_param_list ); typedef void diff --git a/source/cosa/package/slap/services/dslh/SlapDslhParamTree/slap_dslh_paramto_access.c b/source/cosa/package/slap/services/dslh/SlapDslhParamTree/slap_dslh_paramto_access.c index 9c0d2bba1..31d275516 100644 --- a/source/cosa/package/slap/services/dslh/SlapDslhParamTree/slap_dslh_paramto_access.c +++ b/source/cosa/package/slap/services/dslh/SlapDslhParamTree/slap_dslh_paramto_access.c @@ -245,14 +245,14 @@ SetParamValueHelper if ( CCSP_SUCCESS != ret || 1 != size ) { free_parameterValStruct_t (MsgBusHandle, size, ppParamVal); - goto cleanup; /*CID: 71382 and 66253 fix for Resource leak*/ + return returnStatus; } if ( strValStruct[0].type != ppParamVal[0]->type) //datatype miss match { //printf("Exit on Type Miss Match ..\n"); free_parameterValStruct_t (MsgBusHandle, size, ppParamVal); - goto cleanup; /*CID: 71382 and 66253 fix for Resource leak*/ + return returnStatus; } free_parameterValStruct_t (MsgBusHandle, size, ppParamVal); @@ -281,20 +281,6 @@ SetParamValueHelper returnStatus = ANSC_STATUS_SUCCESS; return returnStatus; - -/*CID: 71382 and 66253 fix for Resource leak*/ -cleanup: - if (dst_componentid) - { - AnscFreeMemory(dst_componentid); - } - - if (dst_dbus_path) - { - AnscFreeMemory(dst_dbus_path); - } - - return returnStatus; } /********************************************************************** @@ -761,17 +747,6 @@ SlapDslhParamtoGetParamValue } free_parameterValStruct_t(MsgBusHandle, size, ppParamVal); - /*CID: 64172 and 71299 fix for Resource leak*/ - if (dst_componentid) - { - AnscFreeMemory(dst_componentid); - } - - if (dst_dbus_path) - { - AnscFreeMemory(dst_dbus_path); - } - return pRetSlapVal; } @@ -936,16 +911,6 @@ SlapDslhParamtoGetParamTypeAndValue *ppValue = AnscCloneString((ppParamVal[0]->parameterValue)); } free_parameterValStruct_t(MsgBusHandle, size, ppParamVal); - /*CID: 64681 and 66136 fix for Resource leak*/ - if (dst_componentid) - { - AnscFreeMemory(dst_componentid); - } - - if (dst_dbus_path) - { - AnscFreeMemory(dst_dbus_path); - } } @@ -1596,13 +1561,7 @@ SlapDslhParamtoGetParamInfo if ( CCSP_SUCCESS != ret || 1 > size) { - free_componentStruct_t(MsgBusHandle, size, ppComponents); - /*CID: 61556 fix for Resource leak*/ - if (pParamName != NULL) - { - AnscFreeMemory(pParamName); - } - + free_componentStruct_t(MsgBusHandle, size, ppComponents); if (CCSP_CR_ERR_UNSUPPORTED_NAMESPACE == ret || CCSP_CR_ERR_INVALID_PARAM == ret ) return 1; else @@ -2068,11 +2027,7 @@ SlapDslhParamtoGetParamInfoShort pParamName = AnscCloneString("Device."); } - /*CID: 66694 fix for Resource leak*/ - if (pParamName != NULL) - { - uParentLength = AnscSizeOfString(pParamName); - } + uParentLength = AnscSizeOfString(pParamName); ret = CcspBaseIf_discComponentSupportingNamespace ( @@ -2086,13 +2041,7 @@ SlapDslhParamtoGetParamInfoShort if ( CCSP_SUCCESS != ret || 1 > size) { - free_componentStruct_t(MsgBusHandle, size, ppComponents); - /*CID: 66694 fix for Resource leak*/ - if (pParamName != NULL) - { - AnscFreeMemory(pParamName); - } - + free_componentStruct_t(MsgBusHandle, size, ppComponents); if (CCSP_CR_ERR_UNSUPPORTED_NAMESPACE == ret || CCSP_CR_ERR_INVALID_PARAM == ret ) return 1; else @@ -2706,7 +2655,7 @@ SlapDslhParamtoAddObject { AnscFreeMemory(NumArray); } - goto cleanup; /*CID: 69263 fix for Resource leak*/ + return ANSC_STATUS_FAILURE; } InstanceNumber = NumArray[Nums - 1] + 1; @@ -2723,24 +2672,10 @@ SlapDslhParamtoAddObject if(ret != CCSP_SUCCESS ) { - goto cleanup; /*CID: 69263 fix for Resource leak*/ + return ANSC_STATUS_FAILURE; } return InstanceNumber; - -/*CID: 69263 fix for Resource leak*/ -cleanup: - if (dst_componentid) - { - AnscFreeMemory(dst_componentid); - } - - if (dst_dbus_path) - { - AnscFreeMemory(dst_dbus_path); - } - - return ANSC_STATUS_FAILURE; } @@ -2834,18 +2769,7 @@ SlapDslhParamtoDelObject pObjName ); -/*CID: 59079 and 59659 fix for Resource leak*/ - if (dst_componentid) - { - AnscFreeMemory(dst_componentid); - } - - if (dst_dbus_path) - { - AnscFreeMemory(dst_dbus_path); - } - - if(ret != CCSP_SUCCESS ) + if(ret != CCSP_SUCCESS ) { return ANSC_STATUS_FAILURE; } @@ -3139,33 +3063,19 @@ SlapDslhParamtoIsParameterReadOnly if ( CCSP_SUCCESS != ret || size != 1 ) { free_parameterInfoStruct_t (MsgBusHandle, size, ppParamInfos); - goto cleanup; /*CID: 66124 fix for Resource leak*/ + return bReadOnly; } if ( TRUE == ppParamInfos[0]->writable) { free_parameterInfoStruct_t (MsgBusHandle, size, ppParamInfos); - goto cleanup; /*CID: 66124 fix for Resource leak*/ + return bReadOnly; } free_parameterInfoStruct_t (MsgBusHandle, size, ppParamInfos); bReadOnly = TRUE; return bReadOnly; - -/*CID: 66124 fix for Resource leak*/ -cleanup: - if (dst_componentid) - { - AnscFreeMemory(dst_componentid); - } - - if (dst_dbus_path) - { - AnscFreeMemory(dst_dbus_path); - } - - return bReadOnly; } diff --git a/source/cosa/utilities/bsp_eng/bspeng_archive_co_process.c b/source/cosa/utilities/bsp_eng/bspeng_archive_co_process.c index f30ee74e4..4ffa43f8a 100644 --- a/source/cosa/utilities/bsp_eng/bspeng_archive_co_process.c +++ b/source/cosa/utilities/bsp_eng/bspeng_archive_co_process.c @@ -1276,28 +1276,22 @@ BspTemplateArchiveSaveToFile int size; ULONG ulSize; - while (total < pArchive->ContentLen) + while (total <= pArchive->ContentLen) { - /*CID: 279849 fix for Out-of-bounds access*/ - const char *suffix = ((total > 0) && (total % 40 == 0)) ? "\n" : ""; size = sprintf_s ( buf, sizeof(buf), "%d,%s", pArchive->pStorage[total], - suffix + (total % 40 == 0 && total != 0)?"\n":"" ); if(size < 0) { ERR_CHK(size); } total++; - ulSize = (ULONG)size; /*CID: 559862 fix for Overflowed constant*/ - /*CID: 340787 fix for Improper use of negative value*/ - if (ulSize > 0) - { - AnscWriteFile(hFile, buf, &ulSize); - } + ulSize = size; + AnscWriteFile(hFile, buf, &ulSize); } } else diff --git a/source/dm_pack/dm_pack_xml_helper.c b/source/dm_pack/dm_pack_xml_helper.c index 3e0b1a802..5f75a6540 100644 --- a/source/dm_pack/dm_pack_xml_helper.c +++ b/source/dm_pack/dm_pack_xml_helper.c @@ -54,7 +54,6 @@ #define W_DEFAULT -1 #define N_DEFAULT -1 -#define PARAM_TYPE_COUNT (sizeof(paramName) / sizeof(paramName[0])) /*CID: 280130, 280150 and 280152 fix for Resource leak*/ typedef enum funcNameId { func_GetEntryCount, @@ -217,25 +216,12 @@ PANSC_XML_DOM_NODE_OBJECT pCurrentFunctionsNode=0; PANSC_XML_DOM_NODE_OBJECT DMPackCreateObject(PANSC_XML_DOM_NODE_OBJECT P, int type, char* name, char* maxInstance) { PANSC_XML_DOM_NODE_OBJECT P1 = NULL; - /*CID: 280130 fix for Resource leak*/ - if (!P || !name || (unsigned int)type >= PARAM_TYPE_COUNT) - return NULL; P1 = DMPackCreateNode(P,"object",0,0); - if (!P1) - return NULL; - - if (DMPackCreateNode(P1, "name", name, 0) == NULL) { - return NULL; - } - - if (DMPackCreateNode(P1, "objectType", objectType[type], objectTypeLen[type]) == NULL) { - return NULL; - } - - if (maxInstance && DMPackCreateNode(P1, "maxInstance", maxInstance, 0) == NULL) { - return NULL; - } + DMPackCreateNode(P1,"name",name,0); + DMPackCreateNode(P1,"objectType",objectType[type],objectTypeLen[type]); + if(maxInstance) + DMPackCreateNode(P1,"maxInstance",maxInstance,0); pCurrentFunctionsNode=0; return P1; } @@ -283,84 +269,39 @@ void DMPackCreateFunctions(PANSC_XML_DOM_NODE_OBJECT P, char* name, int numFuncs void DMPackCreateParam(PANSC_XML_DOM_NODE_OBJECT P, char* name, int typeId) { - PANSC_XML_DOM_NODE_OBJECT P1 = NULL; - /* CID:280150 fix for Resource leak */ - if (!P || !name || (unsigned int)typeId >= PARAM_TYPE_COUNT) - { - return; - } - - P1 = DMPackCreateNode(P, "parameter", 0, 0); - if (!P1) return; - - if (DMPackCreateNode(P1, "name", name, 0) == NULL) { - return; - } - - if (DMPackCreateNode(P1, "type", paramName[typeId], paramNameLen[typeId]) == NULL) { - return; - } - - if (DMPackCreateNode(P1, "syntax", paramSyntax[typeId], paramSyntaxLen[typeId]) == NULL) { - return; - } + PANSC_XML_DOM_NODE_OBJECT P1 = DMPackCreateNode(P,"parameter",0,0); + DMPackCreateNode(P1,"name",name,0); + DMPackCreateNode(P1,"type",paramName[typeId],paramNameLen[typeId]); + DMPackCreateNode(P1,"syntax",paramSyntax[typeId],paramSyntaxLen[typeId]); } void DMPackCreateParamEx(PANSC_XML_DOM_NODE_OBJECT P, char* name, int typeId, char* type, char* syntax, int writable, int notify) { PANSC_XML_DOM_NODE_OBJECT P1 = NULL; - /* CID:280152 fix for Resource leak */ - if (!P || !name) - { - return; - } P1 = DMPackCreateNode(P,"parameter",0,0); - if (!P1) return; - if (DMPackCreateNode(P1,"name",name,0) == NULL) { - return; - } + DMPackCreateNode(P1,"name",name,0); - if (type) { - if (DMPackCreateNode(P1,"type",type,0) == NULL) { - return; - } - } else if (typeId >= 0 && (unsigned int)typeId < PARAM_TYPE_COUNT) { - if (DMPackCreateNode(P1,"type",paramName[typeId],paramNameLen[typeId]) == NULL) { - return; - } - } + if(type) + DMPackCreateNode(P1,"type",type,0); + else + DMPackCreateNode(P1,"type",paramName[typeId],paramNameLen[typeId]); - if (syntax) { - if (DMPackCreateNode(P1,"syntax",syntax,0) == NULL) { - return; - } - } else if (typeId >= 0 && (unsigned int)typeId < PARAM_TYPE_COUNT) { - if (DMPackCreateNode(P1,"syntax",paramSyntax[typeId],paramSyntaxLen[typeId]) == NULL) { - return; - } - } + if(syntax) + DMPackCreateNode(P1,"syntax",syntax,0); + else + DMPackCreateNode(P1,"syntax",paramSyntax[typeId],paramSyntaxLen[typeId]); - if (writable == 0) { - if (DMPackCreateNode(P1,"writable","false",5) == NULL) { - return; - } - } else if (writable == 1) { - if (DMPackCreateNode(P1,"writable","true",4) == NULL) { - return; - } - } + if(writable == 0) + DMPackCreateNode(P1,"writable","false",5); + else if(writable == 1) + DMPackCreateNode(P1,"writable","true",4); - if (notify == 0) { - if (DMPackCreateNode(P1,"notify","off",3) == NULL) { - return; - } - } else if (notify == 1) { - if (DMPackCreateNode(P1,"notify","on",2) == NULL) { - return; /* CID 280129 fix */ - } - } + if(notify == 0) + DMPackCreateNode(P1,"notify","off",3); + else if(notify == 1) + DMPackCreateNode(P1,"notify","on",2); /* CID 280129 fix */ } void DMPackCreateParamTSWN(PANSC_XML_DOM_NODE_OBJECT P,char* name,char* T,char* S,int W,int N) { diff --git a/source/util_api/slap/components/SlapScoStandard/slap_scostd_operation.c b/source/util_api/slap/components/SlapScoStandard/slap_scostd_operation.c index 82e7ba523..8a45e784e 100644 --- a/source/util_api/slap/components/SlapScoStandard/slap_scostd_operation.c +++ b/source/util_api/slap/components/SlapScoStandard/slap_scostd_operation.c @@ -235,7 +235,7 @@ SlapScoStdInvokeDispatch } else { - SlapCloneParamList(pMethodDescriptor->ParamListO, pOutputParamList, FALSE); /*CID:186730 for Use after free*/ + SlapCloneParamList(pMethodDescriptor->ParamListO, pOutputParamList); } switch ( pMethodDescriptor->ParamListO->ParamCount ) @@ -379,7 +379,7 @@ SlapScoStdInvokeDispatch returnStatus = ANSC_STATUS_INTERNAL_ERROR; - goto EXIT1; + goto EXIT2; break; } @@ -551,7 +551,7 @@ SlapScoStdInvokeDispatch } else { - SlapCloneParamList(pMethodDescriptor->ParamListO, pOutputParamList, FALSE); /*CID:186730 for Use after free*/ + SlapCloneParamList(pMethodDescriptor->ParamListO, pOutputParamList); } switch ( pMethodDescriptor->ParamListI->ParamCount ) @@ -677,7 +677,7 @@ SlapScoStdInvokeDispatch returnStatus = ANSC_STATUS_INTERNAL_ERROR; - goto EXIT1; + goto EXIT2; break; } @@ -729,7 +729,7 @@ SlapScoStdInvokeDispatch } else { - SlapCloneParamList(pMethodDescriptor->ParamListO, pOutputParamList, FALSE); /*CID:186730 for Use after free*/ + SlapCloneParamList(pMethodDescriptor->ParamListO, pOutputParamList); } switch ( pMethodDescriptor->ParamListO->ParamCount ) @@ -873,7 +873,7 @@ SlapScoStdInvokeDispatch returnStatus = ANSC_STATUS_INTERNAL_ERROR; - goto EXIT1; + goto EXIT2; break; } @@ -1026,7 +1026,7 @@ SlapScoStdInvokeDispatch returnStatus = ANSC_STATUS_INTERNAL_ERROR; - goto EXIT1; /*RDKB-6305, CID-32916, Free unused memory in case of Error*/ + goto EXIT2; /*RDKB-6305, CID-32916, Free unused memory in case of Error*/ break; } @@ -1045,7 +1045,7 @@ SlapScoStdInvokeDispatch } else { - SlapCloneParamList(pMethodDescriptor->ParamListO, pOutputParamList, FALSE); /*CID:186730 for Use after free*/ + SlapCloneParamList(pMethodDescriptor->ParamListO, pOutputParamList); } switch ( pMethodDescriptor->ParamListI->ParamCount ) @@ -1171,7 +1171,7 @@ SlapScoStdInvokeDispatch returnStatus = ANSC_STATUS_INTERNAL_ERROR; - goto EXIT1; + goto EXIT2; break; } @@ -1191,13 +1191,22 @@ SlapScoStdInvokeDispatch GRACEFUL ROLLBACK PROCEDURES AND EXIT DOORS ******************************************************************/ -EXIT1: +EXIT2: - if ( pOutputParamList ) + if ( pOutputParamList ) { SlapFreeParamList(pOutputParamList); } - + + if ( pReturnedVar ) + { + SlapFreeVariable(pReturnedVar); + /* CID 186732 fix */ + pReturnedVar = NULL; + } + +EXIT1: + /*CID: 137471 Resource leak*/ if ( pReturnedVar ) { diff --git a/source/util_api/slap/components/SlapVarHelper/slap_vho_plist.c b/source/util_api/slap/components/SlapVarHelper/slap_vho_plist.c index ae57ebe0d..8562d57ec 100644 --- a/source/util_api/slap/components/SlapVarHelper/slap_vho_plist.c +++ b/source/util_api/slap/components/SlapVarHelper/slap_vho_plist.c @@ -387,8 +387,7 @@ SlapVhoCloneParamList ( ANSC_HANDLE hThisObject, ANSC_HANDLE src_param_list, - ANSC_HANDLE* dst_param_list, - BOOL free_dst_list + ANSC_HANDLE* dst_param_list ) { UNREFERENCED_PARAMETER(hThisObject); @@ -430,12 +429,12 @@ SlapVhoCloneParamList *dst_param_list = dst_list; - /*CID:164052,164053, and 186730 for Resource leak*/ - if (free_dst_list && dst_list) + /*CID:164052,164053 Resource leak in Bmc2ReqcoDoExecute()*/ + if (dst_list) { - SlapFreeParamList(dst_list); - /* CID 186730 fix */ - (dst_list) = NULL; + SlapFreeParamList(dst_list); + /* CID 186730 fix */ + (dst_list) = NULL; } return;