Potential Memory Leak at tee_fs_rpc_opendir of core/tee/tee_fs_rpc.c

[viennadd]

Hi all,

Our code scanner Pinpoint has reported a potential memory leak at the follow:

optee_os/core/tee/tee_fs_rpc.c

Lines 364 to 381 in 24bb751

	struct tee_fs_dir *dir = calloc(1, sizeof(*dir));
	if (!dir)
	return TEE_ERROR_OUT_OF_MEMORY;
	va = tee_fs_rpc_cache_alloc(TEE_FS_NAME_MAX, &mobj, &cookie);
	if (!va) {
	res = TEE_ERROR_OUT_OF_MEMORY;
	goto err_exit;
	}
	op.params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
	op.params[0].u.value.a = OPTEE_MRF_OPENDIR;
	if (!msg_param_init_memparam(op.params + 1, mobj, 0, TEE_FS_NAME_MAX,
	cookie, MSG_PARAM_MEM_DIR_IN))
	return TEE_ERROR_BAD_STATE;

the early return of return TEE_ERROR_BAD_STATE; at line 380 will leak the memory block pointed by dir (line 364) , could someone have a look and see if it needs a patch ?

Best Regards,
Alex, Sourcebrella Inc.

[jforissier]

Hi @viennadd ,

Thanks for reporting. Indeed, line 380 looks wrong and line 384 also. Would you like to submit a pull request?

[viennadd]

@jforissier Sure, I have added an update on res variable and change the statement from return to goto err_exit in line 380 & line line 384, you might want a double check on the PR.