From 03ea436e1cb35fdcba8fb6588de209d0a10174e9 Mon Sep 17 00:00:00 2001 From: Ilya Pankratov <90714492+i-pankrat@users.noreply.github.com> Date: Wed, 5 Jun 2024 20:16:01 +0300 Subject: bugfix: fix various resource leaks (#6367) Fix memory and descriptor leaks. Signed-off-by: Ilya Pankratov --- src/fids/main.c | 2 +- src/firecfg/desktop_files.c | 3 +++ src/firejail/bandwidth.c | 3 +++ src/firejail/fs_home.c | 12 +++++++++--- src/firejail/ids.c | 2 ++ src/firejail/run_files.c | 2 ++ src/firejail/util.c | 1 + src/firemon/netstats.c | 2 ++ src/jailcheck/access.c | 3 +++ src/jailcheck/noexec.c | 2 ++ src/jailcheck/virtual.c | 1 + 11 files changed, 29 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/fids/main.c b/src/fids/main.c index 92b6468f3..415694f1e 100644 --- a/src/fids/main.c +++ b/src/fids/main.c @@ -106,9 +106,9 @@ static void file_checksum(const char *fname) { } else { content = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0); - close(fd); mmapped = 1; } + close(fd); unsigned char checksum[KEY_SIZE / 8]; blake2b(checksum, sizeof(checksum), content, size); diff --git a/src/firecfg/desktop_files.c b/src/firecfg/desktop_files.c index 1895e437b..8c21757ab 100644 --- a/src/firecfg/desktop_files.c +++ b/src/firecfg/desktop_files.c @@ -300,6 +300,7 @@ void fix_desktop_files(const char *homedir) { if (stat(outname, &sb) == 0) { printf(" %s skipped: file exists\n", filename); + free(outname); if (change_exec) free(change_exec); continue; @@ -308,6 +309,7 @@ void fix_desktop_files(const char *homedir) { FILE *fpin = fopen(filename, "r"); if (!fpin) { fprintf(stderr, "Warning: cannot open /usr/share/applications/%s\n", filename); + free(outname); if (change_exec) free(change_exec); continue; @@ -317,6 +319,7 @@ void fix_desktop_files(const char *homedir) { if (!fpout) { fprintf(stderr, "Warning: cannot open ~/.local/share/applications/%s\n", outname); fclose(fpin); + free(outname); if (change_exec) free(change_exec); continue; diff --git a/src/firejail/bandwidth.c b/src/firejail/bandwidth.c index db130afd3..cbfcc90ed 100644 --- a/src/firejail/bandwidth.c +++ b/src/firejail/bandwidth.c @@ -198,6 +198,8 @@ static void read_bandwidth_file(pid_t pid) { fclose(fp); } + + free(fname); } static void write_bandwidth_file(pid_t pid) { @@ -217,6 +219,7 @@ static void write_bandwidth_file(pid_t pid) { ptr = ptr->next; } fclose(fp); + free(fname); } else goto errout; diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c index 7c3f3835b..9d9832c15 100644 --- a/src/firejail/fs_home.c +++ b/src/firejail/fs_home.c @@ -67,8 +67,10 @@ static void skel(const char *homedir) { if (asprintf(&fname, "%s/.zshrc", homedir) == -1) errExit("asprintf"); // don't copy it if we already have the file - if (access(fname, F_OK) == 0) + if (access(fname, F_OK) == 0) { + free(fname); return; + } if (is_link(fname)) { // access(3) on dangling symlinks fails, try again using lstat fprintf(stderr, "Error: invalid %s file\n", fname); exit(1); @@ -91,8 +93,10 @@ static void skel(const char *homedir) { if (asprintf(&fname, "%s/.cshrc", homedir) == -1) errExit("asprintf"); // don't copy it if we already have the file - if (access(fname, F_OK) == 0) + if (access(fname, F_OK) == 0) { + free(fname); return; + } if (is_link(fname)) { // access(3) on dangling symlinks fails, try again using lstat fprintf(stderr, "Error: invalid %s file\n", fname); exit(1); @@ -115,8 +119,10 @@ static void skel(const char *homedir) { if (asprintf(&fname, "%s/.bashrc", homedir) == -1) errExit("asprintf"); // don't copy it if we already have the file - if (access(fname, F_OK) == 0) + if (access(fname, F_OK) == 0) { + free(fname); return; + } if (is_link(fname)) { // access(3) on dangling symlinks fails, try again using lstat fprintf(stderr, "Error: invalid %s file\n", fname); exit(1); diff --git a/src/firejail/ids.c b/src/firejail/ids.c index 40bbe6d02..0759a205d 100644 --- a/src/firejail/ids.c +++ b/src/firejail/ids.c @@ -42,6 +42,7 @@ static void ids_init(void) { if (dup(fd) != STDOUT_FILENO) errExit("dup"); close(fd); + free(fname); sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3, PATH_FIDS, "--init", cfg.homedir); } @@ -63,6 +64,7 @@ static void ids_check(void) { if (dup(fd) != STDIN_FILENO) errExit("dup"); close(fd); + free(fname); sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP| SBOX_ALLOW_STDIN, 3, PATH_FIDS, "--check", cfg.homedir); } diff --git a/src/firejail/run_files.c b/src/firejail/run_files.c index cb078b580..4bd0ba459 100644 --- a/src/firejail/run_files.c +++ b/src/firejail/run_files.c @@ -122,6 +122,7 @@ void set_name_run_file(pid_t pid) { // mode and ownership SET_PERMS_STREAM(fp, 0, 0, 0644); fclose(fp); + free(fname); } @@ -141,6 +142,7 @@ void set_x11_run_file(pid_t pid, int display) { // mode and ownership SET_PERMS_STREAM(fp, 0, 0, 0644); fclose(fp); + free(fname); } void set_profile_run_file(pid_t pid, const char *fname) { diff --git a/src/firejail/util.c b/src/firejail/util.c index 323133f8d..5d7c244b1 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c @@ -1392,6 +1392,7 @@ void enter_network_namespace(pid_t pid) { fprintf(stderr, "Error: the sandbox doesn't use a new network namespace\n"); exit(1); } + free(name); // join the namespace EUID_ROOT(); diff --git a/src/firemon/netstats.c b/src/firemon/netstats.c index 39dc38ec9..e70174b1e 100644 --- a/src/firemon/netstats.c +++ b/src/firemon/netstats.c @@ -152,10 +152,12 @@ static void print_proc(int index, int itv, int col) { struct stat s; if (stat(name, &s) == -1) { // the sandbox doesn't have a --net= option, don't print + free(name); if (cmd) free(cmd); return; } + free(name); // pid char pidstr[11]; diff --git a/src/jailcheck/access.c b/src/jailcheck/access.c index 50c51839b..5fbcb5a15 100644 --- a/src/jailcheck/access.c +++ b/src/jailcheck/access.c @@ -80,10 +80,13 @@ void access_setup(const char *directory) { FILE *fp = fopen(test_file, "w"); if (!fp) { printf("Warning: I cannot create test file in directory %s, skipping...\n", directory); + free(test_file); + free(path); return; } fprintf(fp, "this file was created by firetest utility, you can safely delete it\n"); fclose(fp); + free(path); int rv = chown(test_file, user_uid, user_gid); if (rv) errExit("chown"); diff --git a/src/jailcheck/noexec.c b/src/jailcheck/noexec.c index 37234c648..e5657135d 100644 --- a/src/jailcheck/noexec.c +++ b/src/jailcheck/noexec.c @@ -55,6 +55,7 @@ void noexec_setup(void) { execfile_len = s.st_size; close(fd); } + free(self); } } @@ -110,4 +111,5 @@ void noexec_test(const char *path) { wait(&status); int rv = unlink(fname); (void) rv; + free(fname); } diff --git a/src/jailcheck/virtual.c b/src/jailcheck/virtual.c index d4bfd1923..348efc784 100644 --- a/src/jailcheck/virtual.c +++ b/src/jailcheck/virtual.c @@ -49,6 +49,7 @@ void virtual_setup(const char *directory) { FILE *fp = fopen(test_file, "w"); if (!fp) { printf("Warning: I cannot create test file in directory %s, skipping...\n", directory); + free(test_file); return; } fprintf(fp, "this file was created by firetest utility, you can safely delete it\n"); -- cgit v1.2.3-54-g00ecf