[apparmor] Memory leaks in parser/parser_regex.c (at least)

[Steve Beattie]

On Thu, Aug 27, 2015 at 03:24:09PM +0200, intrigeri wrote:
> Steve Beattie wrote (27 Aug 2015 05:46:15 GMT) :
> > With that applied, local testing with AddressSanitzer shows the
> > caching tests failing due to leaking cached and feature objects
> > from libapparmor. I'll dig into it tomorrow.
> 
> Not sure if it's the same problem, but I see that:
> 
> FAIL: tst_aalogmisc
> ===================
> 
> =================================================================
> ==9632==ERROR: LeakSanitizer: detected memory leaks
> 
> Direct leak of 20 byte(s) in 1 object(s) allocated from:
>     #0 0x7f143d8ea37a in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9437a)
>     #1 0x403423 in hex_to_string /tmp/buildd/apparmor-2.10/libraries/libapparmor/src/libaalogparse.c:140
>     #2 0x401d8e in main /tmp/buildd/apparmor-2.10/libraries/libapparmor/src/tst_aalogmisc.c:34
>     #3 0x7f143c7bfb44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
> 
> Direct leak of 15 byte(s) in 1 object(s) allocated from:
>     #0 0x7f143d8ea37a in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9437a)
>     #1 0x7f143c893f6f in __vasprintf_chk (/lib/x86_64-linux-gnu/libc.so.6+0xf5f6f)
> 
> Direct leak of 4 byte(s) in 1 object(s) allocated from:
>     #0 0x7f143d8ea37a in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9437a)
>     #1 0x7f143c81f9e9 in strdup (/lib/x86_64-linux-gnu/libc.so.6+0x819e9)
> 
> Direct leak of 2 byte(s) in 1 object(s) allocated from:
>     #0 0x7f143d8ea37a in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9437a)
>     #1 0x403423 in hex_to_string /tmp/buildd/apparmor-2.10/libraries/libapparmor/src/libaalogparse.c:140
>     #2 0x401db9 in main /tmp/buildd/apparmor-2.10/libraries/libapparmor/src/tst_aalogmisc.c:38
>     #3 0x7f143c7bfb44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
> 
> Direct leak of 1 byte(s) in 1 object(s) allocated from:
>     #0 0x7f143d8ea37a in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9437a)
>     #1 0x403423 in hex_to_string /tmp/buildd/apparmor-2.10/libraries/libapparmor/src/libaalogparse.c:140
>     #2 0x401e2d in main /tmp/buildd/apparmor-2.10/libraries/libapparmor/src/tst_aalogmisc.c:41
>     #3 0x7f143c7bfb44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
> 
> SUMMARY: AddressSanitizer: 42 byte(s) leaked in 5 allocation(s).
> FAIL tst_aalogmisc (exit status: 23)

Nope, that's more unit tests leaking memory. Try the following patch:

Signed-off-by: Steve Beattie <steve at nxnw.org>
---
 libraries/libapparmor/src/tst_aalogmisc.c |    6 ++++++
 1 file changed, 6 insertions(+)

Index: b/libraries/libapparmor/src/tst_aalogmisc.c
===================================================================
--- a/libraries/libapparmor/src/tst_aalogmisc.c
+++ b/libraries/libapparmor/src/tst_aalogmisc.c
@@ -34,19 +34,25 @@ int main(void)
 	retstr = hex_to_string("2F746D702F646F6573206E6F74206578697374");
 	MY_TEST(retstr, "basic allocation");
 	MY_TEST(strcmp(retstr, "/tmp/does not exist") == 0, "basic dehex 1");
+	free(retstr);
 
 	retstr = hex_to_string("61");
 	MY_TEST(strcmp(retstr, "a") == 0, "basic dehex 2");
+	free(retstr);
 
 	retstr = hex_to_string("");
 	MY_TEST(strcmp(retstr, "") == 0, "empty string");
+	free(retstr);
 
 	/* ipproto_to_string() tests */
 	retstr = ipproto_to_string((unsigned) 99999);
 	MY_TEST(strcmp(retstr, "unknown(99999)") == 0, "invalid protocol test");
+	free(retstr);
 
 	retstr = ipproto_to_string((unsigned) 6);
 	MY_TEST(strcmp(retstr, "tcp") == 0, "protocol=tcp");
+	free(retstr);
+
 	return rc;
 }
 
The stuff I'm seeing is from running make check on the parser from the
tip of the trunk in bzr, and getting failures in the caching tests like
so:

======================================================================
FAIL: test_profile_newer_skips_cache (__main__.AAParserAltCacheTests)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/steve/bzr/apparmor/parser/tst/testlib.py", line 50, in new_unittest_func
    return unittest_func(self)
  File "./caching.py", line 384, in test_profile_newer_skips_cache
    self._generate_cache_file()
  File "./caching.py", line 233, in _generate_cache_file
    self.run_cmd_check(cmd)
  File "/home/steve/bzr/apparmor/parser/tst/testlib.py", line 73, in run_cmd_check
    self.assertEqual(rc, expected_rc, "Got return code %d, expected %d\nCommand run: %s\nOutput: %s" % (rc, expected_rc, (' %'.join(command)), report))
AssertionError: 23 != 0 : Got return code 23, expected 0
Command run: ../apparmor_parser --base /home/steve/tmp/aa-caching-z8l3_5xj --skip-kernel-load --cache-loc /home/steve/tmp/aa-caching-z8l3_5xj/aa-alt-cachexyu9sztn -q --write-cache -r /home/steve/tmp/aa-caching-z8l3_5xj/sbin.pingy
Output:
=================================================================
==14259==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x7f61775ecb49 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98b49)
    #1 0x4bb679 in aa_policy_cache_new /home/steve/bzr/apparmor/libraries/libapparmor/src/policy_cache.c:151
    #2 0x41e968 in main /home/steve/bzr/apparmor/parser/parser_main.c:921
    #3 0x7f6176c84a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)

SUMMARY: AddressSanitizer: 32 byte(s) leaked in 1 allocation(s).


----------------------------------------------------------------------


-- 
Steve Beattie
<sbeattie at ubuntu.com>
http://NxNW.org/~steve/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20150827/0fc428ee/attachment.pgp>