Merge pull request #147 from wenningerk/coverity_issues

Fix: query-watchdog: avoid issues on heap allocation failing

Author: wenningerk

sbd.spec

@@ -49,7 +49,7 @@
 
 Name:           sbd
 Summary:        Storage-based death
-License:        GPLv2+
+License:        GPL-2.0-or-later
 Group:          System Environment/Daemons
 Version:        1.5.2
 Release:        99.%{buildnum}.%{shortcommit}.%{modified}git%{?dist}
@@ -95,7 +95,7 @@ Available rpmbuild rebuild options:
 
 %package tests
 Summary:        Storage-based death environment for regression tests
-License:        GPLv2+
+License:        GPL-2.0-or-later
 Group:          System Environment/Daemons
 
 %description tests

src/sbd-common.c

@@ -385,8 +385,17 @@ watchdog_populate_list(void)
                     struct link_list_item *lli =
                         calloc(1, sizeof(struct link_list_item));
 
+                    if (lli == NULL) {
+                        break;
+                    }
                     lli->dev_node = strdup(buf);
                     lli->link_name = strdup(entry_name);
+                    if ((lli->dev_node == NULL) || (lli->link_name == NULL)) {
+                        free(lli->dev_node);
+                        free(lli->link_name);
+                        free(lli);
+                        break;
+                    }
                     lli->next = link_list;
                     link_list = lli;
                 }
@@ -404,18 +413,27 @@ watchdog_populate_list(void)
                 if(!stat(entry_name, &statbuf) && S_ISCHR(statbuf.st_mode) &&
                    is_watchdog(statbuf.st_rdev)) {
 
-                    int wdfd = watchdog_init_fd(entry_name, -1);
+                    int wdfd;
                     struct watchdog_list_item *wdg =
                         calloc(1, sizeof(struct watchdog_list_item));
                     int len;
                     struct link_list_item *tmp_list = NULL;
 
+                    if (wdg == NULL) {
+                        break;
+                    }
+
                     wdg->dev = statbuf.st_rdev;
                     wdg->dev_node = strdup(entry_name);
+                    if (wdg->dev_node == NULL) {
+                        free(wdg);
+                        break;
+                    }
                     wdg->next = watchdog_list;
                     watchdog_list = wdg;
                     watchdog_list_items++;
 
+                    wdfd = watchdog_init_fd(entry_name, -1);
                     if (wdfd >= 0) {
                         struct watchdog_info ident;
 
@@ -450,11 +468,18 @@ watchdog_populate_list(void)
                             struct watchdog_list_item *dupe_wdg =
                                 calloc(1, sizeof(struct watchdog_list_item));
 
+                            if (dupe_wdg == NULL) {
+                                break;
+                            }
                             /* as long as we never purge watchdog_list
                              * there is no need to dupe strings
                              */
                             *dupe_wdg = *wdg;
                             dupe_wdg->dev_node = strdup(tmp_list->link_name);
+                            if (dupe_wdg->dev_node == NULL) {
+                                free(dupe_wdg);
+                                break;
+                            }
                             dupe_wdg->next = watchdog_list;
                             watchdog_list = dupe_wdg;
                             watchdog_list_items++;

src/sbd-md.c

@@ -441,9 +441,9 @@ init_device(struct sbd_context *st)
 		}
 	}
 
-out:	free(s_node);
+out:	free(s_mbox);
+	free(s_node);
 	free(s_header);
-	free(s_mbox);
 	return(rc);
 }
 
@@ -556,9 +556,9 @@ slot_allocate(struct sbd_context *st, const char *name)
 		}
 	}
 
-out:	free(s_node);
+out:	free(s_mbox);
+	free(s_node);
 	free(s_header);
-	free(s_mbox);
 	return(rc);
 }
 
@@ -1279,11 +1279,10 @@ int servant_md(const char *diskname, int mode, const void* argp)
 		}
 	}
  out:
-	free(s_header);
 	free(s_node);
 	free(s_mbox);
+	free(s_header);
 	close_device(st);
 	exit(rc);
 }
 
-