Bug Summary

File:file.c
Warning:line 132, column 8
Use of memory after it is freed

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-redhat-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name file.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu icelake-server -target-feature -avx512pf -target-feature -tsxldtrk -target-feature +cx16 -target-feature +sahf -target-feature -tbm -target-feature +avx512ifma -target-feature +sha -target-feature +crc32 -target-feature -fma4 -target-feature +vpclmulqdq -target-feature +prfchw -target-feature +bmi2 -target-feature -cldemote -target-feature +fsgsbase -target-feature -avx512bf16 -target-feature -amx-tile -target-feature -raoint -target-feature -uintr -target-feature +gfni -target-feature +popcnt -target-feature -ptwrite -target-feature +aes -target-feature +avx512bitalg -target-feature -movdiri -target-feature -widekl -target-feature +xsaves -target-feature -avx512er -target-feature -avxvnni -target-feature -avx512fp16 -target-feature +avx512vnni -target-feature -amx-bf16 -target-feature -avxvnniint8 -target-feature +avx512vpopcntdq -target-feature +pconfig -target-feature +clwb -target-feature -cmpccxadd -target-feature +xsavec -target-feature -clzero -target-feature +pku -target-feature -amx-fp16 -target-feature +mmx -target-feature -lwp -target-feature +rdpid -target-feature -xop -target-feature +rdseed -target-feature -waitpkg -target-feature -prefetchi -target-feature -kl -target-feature -movdir64b -target-feature -sse4a -target-feature +avx512bw -target-feature -avxneconvert -target-feature +clflushopt -target-feature +xsave -target-feature +avx512vbmi2 -target-feature +64bit -target-feature +avx512vl -target-feature -serialize -target-feature -hreset -target-feature +invpcid -target-feature +avx512cd -target-feature +avx -target-feature +vaes -target-feature -amx-int8 -target-feature +cx8 -target-feature +fma -target-feature -rtm -target-feature +bmi -target-feature -enqcmd -target-feature +rdrnd -target-feature -mwaitx -target-feature +sse4.1 -target-feature +sse4.2 -target-feature +avx2 -target-feature +fxsr -target-feature +wbnoinvd -target-feature +sse -target-feature +lzcnt -target-feature +pclmul -target-feature -rdpru -target-feature -avxifma -target-feature +f16c -target-feature +ssse3 -target-feature +sgx -target-feature -prefetchwt1 -target-feature +cmov -target-feature +avx512vbmi -target-feature -shstk -target-feature +movbe -target-feature -avx512vp2intersect -target-feature +xsaveopt -target-feature +avx512dq -target-feature +sse2 -target-feature +adx -target-feature +sse3 -target-feature -avx512f -debugger-tuning=gdb -ftest-coverage -fprofile-arcs -fcoverage-compilation-dir=/var/jenkins/workspace/scan-build-docker-autotest/spdk/lib/util -resource-dir /usr/lib64/clang/16 -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/build/libvfio-user/usr/local/include -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/include -D _GNU_SOURCE -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/isa-l/.. -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/isalbuild -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/isa-l-crypto/.. -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/isalcryptobuild -D DEBUG -D SPDK_GIT_COMMIT=d9917142f -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/build/libvfio-user/usr/local/include -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/include -D _GNU_SOURCE -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/isa-l/.. -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/isalbuild -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/isa-l-crypto/.. -I /var/jenkins/workspace/scan-build-docker-autotest/spdk/isalcryptobuild -D DEBUG -D SPDK_GIT_COMMIT=d9917142f -internal-isystem /usr/lib64/clang/16/include -internal-isystem /usr/local/include -internal-isystem /usr/bin/../lib/gcc/x86_64-redhat-linux/13/../../../../x86_64-redhat-linux/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -O0 -Wno-unused-parameter -Wno-missing-field-initializers -Wno-pointer-sign -Wno-unused-parameter -Wno-missing-field-initializers -Wno-pointer-sign -std=gnu11 -fdebug-compilation-dir=/var/jenkins/workspace/scan-build-docker-autotest/spdk/lib/util -ferror-limit 19 -fsanitize=address,alignment,array-bounds,bool,builtin,enum,float-cast-overflow,function,integer-divide-by-zero,nonnull-attribute,null,pointer-overflow,return,returns-nonnull-attribute,shift-base,shift-exponent,signed-integer-overflow,unreachable,vla-bound,vptr -fsanitize-recover=alignment,array-bounds,bool,builtin,enum,float-cast-overflow,function,integer-divide-by-zero,nonnull-attribute,null,pointer-overflow,returns-nonnull-attribute,shift-base,shift-exponent,signed-integer-overflow,vla-bound,vptr -fsanitize-system-ignorelist=/usr/lib64/clang/16/share/asan_ignorelist.txt -fno-sanitize-memory-param-retval -fsanitize-address-use-after-scope -fno-assume-sane-operator-new -stack-protector 1 -fgnuc-version=4.2.1 -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /var/jenkins/workspace/scan-build-docker-autotest/output/scan-build-tmp/2024-07-15-171008-16814-1 -x c file.c
1/* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright (C) 2015 Intel Corporation.
3 * All rights reserved.
4 */
5
6#include "spdk/file.h"
7#include "spdk/string.h"
8
9void *
10spdk_posix_file_load(FILE *file, size_t *size)
11{
12 uint8_t *newbuf, *buf = NULL((void*)0);
13 size_t rc, buf_size, cur_size = 0;
14
15 *size = 0;
16 buf_size = 128 * 1024;
17
18 while (buf_size <= 1024 * 1024 * 1024) {
19 newbuf = realloc(buf, buf_size);
20 if (newbuf == NULL((void*)0)) {
21 free(buf);
22 return NULL((void*)0);
23 }
24 buf = newbuf;
25
26 rc = fread(buf + cur_size, 1, buf_size - cur_size, file);
27 cur_size += rc;
28
29 if (feof(file)) {
30 *size = cur_size;
31 return buf;
32 }
33
34 if (ferror(file)) {
35 free(buf);
36 return NULL((void*)0);
37 }
38
39 buf_size *= 2;
40 }
41
42 free(buf);
43 return NULL((void*)0);
44}
45
46void *
47spdk_posix_file_load_from_name(const char *file_name, size_t *size)
48{
49 FILE *file = fopen(file_name, "r");
50 void *data;
51
52 if (file == NULL((void*)0)) {
53 return NULL((void*)0);
54 }
55
56 data = spdk_posix_file_load(file, size);
57 fclose(file);
58
59 return data;
60}
61
62static int
63read_sysfs_attribute(char **attribute_p, const char *format, va_list args)
64{
65 char *attribute;
66 FILE *file;
67 char *path;
68 size_t len = 0;
69 ssize_t read;
70
71 path = spdk_vsprintf_alloc(format, args);
72 if (path == NULL((void*)0)) {
2
←
Assuming 'path' is not equal to NULL
→
3
←
Taking false branch
→
73 return -ENOMEM12;
74 }
75
76 file = fopen(path, "r");
77 free(path);
78 if (file == NULL((void*)0)) {
4
←
Assuming 'file' is not equal to NULL
→
5
←
Taking false branch
→
79 return -errno(*__errno_location ());
80 }
81
82 *attribute_p = NULL((void*)0);
83 read = getline(attribute_p, &len, file);
84 fclose(file);
85 attribute = *attribute_p;
86 if (read == -1) {
6
←
Assuming the condition is true
→
7
←
Taking true branch
→
87 /* getline man page says line should be freed even on failure. */
88 free(attribute);
8
←
Memory is released
→
89 return -errno(*__errno_location ());
90 }
91
92 /* len is the length of the allocated buffer, which may be more than
93 * the string's length. Reuse len to hold the actual strlen.
94 */
95 len = strlen(attribute);
96 if (attribute[len - 1] == '\n') {
97 attribute[len - 1] = '\0';
98 }
99
100 return 0;
101}
102
103int
104spdk_read_sysfs_attribute(char **attribute_p, const char *path_format, ...)
105{
106 va_list args;
107 int rc;
108
109 va_start(args, path_format)__builtin_va_start(args, path_format);
110 rc = read_sysfs_attribute(attribute_p, path_format, args);
111 va_end(args)__builtin_va_end(args);
112
113 return rc;
114}
115
116int
117spdk_read_sysfs_attribute_uint32(uint32_t *attribute, const char *path_format, ...)
118{
119 char *attribute_str = NULL((void*)0);
120 long long int val;
121 va_list args;
122 int rc;
123
124 va_start(args, path_format)__builtin_va_start(args, path_format);
125 rc = read_sysfs_attribute(&attribute_str, path_format, args);
1
Calling 'read_sysfs_attribute'
→
9
←
Returning; memory was released via 1st parameter
→
126 va_end(args)__builtin_va_end(args);
127
128 if (rc != 0) {
10
←
Assuming 'rc' is equal to 0
→
11
←
Taking false branch
→
129 return rc;
130 }
131
132 val = spdk_strtoll(attribute_str, 0);
12
←
Use of memory after it is freed
133 free(attribute_str);
134 if (val < 0 || val > UINT32_MAX(4294967295U)) {
135 return -EINVAL22;
136 }
137
138 *attribute = (uint32_t)val;
139 return 0;
140}