Uploaded image for project: 'WiredTiger'
  1. WiredTiger
  2. WT-2234

Coverity #1339897 and #1339898

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • WT2.7.0
    • Affects Version/s: None
    • Component/s: None
    • None

      *** CID 1339898:  Memory - corruptions  (OVERRUN)
      /src/cursor/cur_join.c: 40 in __curjoin_entry_iter_init()
      34      to_dup = entry->ends[0].cursor;
      35
      36      uri = to_dup->uri;
      37      if (F_ISSET((WT_CURSOR *)cjoin, WT_CURSTD_RAW))
      38              config = &raw_cfg[0];
      39      else
      >>>     CID 1339898:  Memory - corruptions  (OVERRUN)
      >>>     Assigning: "config" = "&def_cfg[0]". "config" now points to element 0 of "def_cfg" (which consists of 2 8-byte elements).
      40              config = &def_cfg[0];
      41
      42      if (cjoin->projection != NULL) {
      43              size = strlen(uri) + strlen(cjoin->projection) + 1;
      44              WT_ERR(__wt_calloc(session, size, 1, &uribuf));
      45              snprintf(uribuf, size, "%s%s", uri, cjoin->projection);
      
      ** CID 1339897:  Resource leaks  (RESOURCE_LEAK)
      /ext/extractors/csv/csv_extractor.c: 101 in csv_extract()
      
      
      *** CID 1339897:  Resource leaks  (RESOURCE_LEAK)
      /ext/extractors/csv/csv_extractor.c: 101 in csv_extract()
      95              if ((copy = malloc(len + 1)) == NULL)
      96                      return (errno);
      97              strncpy(copy, p, len);
      98              copy[len] = '\0';
      99              if (csv_extractor->format_isnum) {
      100                             if ((val = atoi(copy)) < 0)
      >>>     CID 1339897:  Resource leaks  (RESOURCE_LEAK)
      >>>     Variable "copy" going out of scope leaks the storage it points to.
      101                                     return (EINVAL);
      102                             result_cursor->set_key(result_cursor, val);
      103                     } else
      104                             result_cursor->set_key(result_cursor, copy);
      105                     ret = result_cursor->insert(result_cursor);
      106                     free(copy);
      

            Assignee:
            keith.bostic@mongodb.com Keith Bostic (Inactive)
            Reporter:
            keith.bostic@mongodb.com Keith Bostic (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: