Uploaded image for project: 'C Driver'
  1. C Driver
  2. CDRIVER-3515

_mongoc_get_rr_search calls free instead of bson_free on bson_malloc'ed object

    • Type: Icon: Bug Bug
    • Resolution: Fixed
    • Priority: Icon: Trivial - P5 Trivial - P5
    • 1.16.1
    • Affects Version/s: 1.16.0
    • Component/s: libmongoc

      Found with this CodeQL query (which checks for function returns where variables that are assigned a result of a bson_malloc* have no associated bson_free statement):

      import cpp
      
      from FunctionCall alloc, LocalScopeVariable v, ReturnStmt return
      where
      (
          alloc.getTarget().getQualifiedName() = "bson_malloc" or
          alloc.getTarget().getQualifiedName() = "bson_malloc0" or
          alloc.getTarget().getQualifiedName() = "bson_realloc" or
          alloc.getTarget().getQualifiedName() = "bson_calloc"
      ) and
      v.getAnAssignedValue() = alloc and
      alloc.getASuccessor+() = return and
      not alloc.getEnclosingFunction().getQualifiedName().matches("%new%") and
      not alloc.getEnclosingFunction().getQualifiedName().matches("%dup%") and
      not alloc.getEnclosingFunction().getQualifiedName().matches("%clone%") and
      not alloc.getEnclosingFunction().getQualifiedName().matches("%init%") and
      not return.getExpr() = v.getAnAccess() and
      not exists (FunctionCall free |
          free.getTarget().getQualifiedName() = "bson_free" and
          free.getAnArgument() = v.getAnAccess() and
          free.getASuccessor+() = return and 
          free.getAPredecessor+() = alloc
      )
      
      select return, "leaks", v, "in ", alloc.getEnclosingFunction().getQualifiedName()
      

            Assignee:
            kevin.albertson@mongodb.com Kevin Albertson
            Reporter:
            kevin.albertson@mongodb.com Kevin Albertson
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: