After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 785112 - Freeing NONHEAP_MEMORY.STRING
Freeing NONHEAP_MEMORY.STRING
Status: RESOLVED WONTFIX
Product: GStreamer
Classification: Platform
Component: gstreamer (core)
1.12.2
Other All
: Normal minor
: git master
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2017-07-19 09:26 UTC by Ashish Kumar
Modified: 2018-05-07 16:05 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
Patch for the issue attached (1.31 KB, patch)
2017-07-25 08:59 UTC, Ashish Kumar
needs-work Details | Review
modified patch (1.31 KB, patch)
2017-07-25 10:44 UTC, Ashish Kumar
none Details | Review

Description Ashish Kumar 2017-07-19 09:26:04 UTC
Memory deallocation function called at gstdebugutils.c:213 by calling function 'g_free' receives pointer 'tmp', which was assigned a pointer to non-heap memory at gstdebugutils.c:201


Line no:201  
           tmp = (char *) "";

Line no:213
           g_free (tmp);
Comment 1 Sebastian Dröge (slomo) 2017-07-19 09:29:22 UTC
Do you want to provide a patch for this?
Comment 2 Ashish Kumar 2017-07-19 09:36:43 UTC
Yes, I am preparing a patch to fix the bug and will upload it soon.
Comment 3 Ashish Kumar 2017-07-19 09:39:35 UTC
(In reply to Sebastian Dröge (slomo) from comment #1)
> Do you want to provide a patch for this?
Yes, I am preparing a patch to fix the bug and will upload it soon.
Comment 4 Tim-Philipp Müller 2017-07-19 09:43:51 UTC
Please don't file bugs with "critical" severity unless they really are severe. Corner-case issues found by a static code analyzer are more often than not not critical.

In this case, there is no bug, the g_free is guarded:

        if (tmp[0] != '\0')
          g_free (tmp);
Comment 5 Sebastian Dröge (slomo) 2017-07-21 10:25:05 UTC
Ashish, anything left to be done here?
Comment 6 Ashish Kumar 2017-07-21 11:17:11 UTC
Yes, I can provide a patch, but will it be accepted considering Mr. Tim's opinion.(In reply to Sebastian Dröge (slomo) from comment #5)
> Ashish, anything left to be done here?

Yes, I can provide a patch, but will it be accepted considering Mr. Tim's opinion ?
Comment 7 Sebastian Dröge (slomo) 2017-07-21 11:22:56 UTC
Well, is your patch going to be correct? It seems like there's nothing to be changed here
Comment 8 Tim-Philipp Müller 2017-07-21 11:27:27 UTC
I'm happy to accept a patch that improves the code to make it nicer. I'm just saying that the static analyzer is wrong and that there is no actual bug here in this particular case.
Comment 9 Ashish Kumar 2017-07-24 04:57:45 UTC
(In reply to Sebastian Dröge (slomo) from comment #7)
> Well, is your patch going to be correct? It seems like there's nothing to be
> changed here

It can be corrected if we remove below code segment which is redundant :-

LnNo.198        if (param_name)
LnNo.199          tmp = param_name;
LnNo.200        else
LnNo.201          tmp = (char *) ""; 


as 

LnNo.101  gchar *param_name = NULL;

and is not assigned anything till 
LnNo.204      param_name = g_strdup_printf ("%s\\n%s=%s", tmp, property->name,
              value_str);

Also we can modify the statements at LnNo. 204 and 207 as like below:
          param_name = g_strdup_printf ("\\n%s=%s",property->name,
              value_str);
Comment 10 Sebastian Dröge (slomo) 2017-07-24 06:46:03 UTC
Can you provide a patch? That makes it more clear what you mean
Comment 11 Ashish Kumar 2017-07-24 08:38:36 UTC
(In reply to Sebastian Dröge (slomo) from comment #10)
> Can you provide a patch? That makes it more clear what you mean

Ok, I will submit the patch.
Comment 12 Ashish Kumar 2017-07-25 08:59:07 UTC
Created attachment 356344 [details] [review]
Patch for the issue attached

Please review the patch and provide your feedback
Comment 13 Sebastian Dröge (slomo) 2017-07-25 09:07:46 UTC
Review of attachment 356344 [details] [review]:

::: gst/gstdebugutils.c
@@ +198,2 @@
         if (details & GST_DEBUG_GRAPH_SHOW_FULL_PARAMS) {
+          param_name = g_strdup_printf ("\\n%s=%s", property->name,

This is changing behaviour. You're not prefixing with the property_name anymore. Also below
Comment 14 Ashish Kumar 2017-07-25 10:44:07 UTC
Created attachment 356350 [details] [review]
modified patch

modified patch with prefixing by empty string.
Comment 15 Ashish Kumar 2017-07-25 10:44:50 UTC
(In reply to Sebastian Dröge (slomo) from comment #13)
> Review of attachment 356344 [details] [review] [review]:
> 
> ::: gst/gstdebugutils.c
> @@ +198,2 @@
>          if (details & GST_DEBUG_GRAPH_SHOW_FULL_PARAMS) {
> +          param_name = g_strdup_printf ("\\n%s=%s", property->name,
> 
> This is changing behaviour. You're not prefixing with the property_name
> anymore. Also below

----------------------------------
In the original code 'property->name' is always prefixed by an empty string as 'tmp' is always assigned empty string ""
------------------
LnNo.198        if (param_name)     //'param_name' always 'NULL' here
LnNo.199          tmp = param_name; //control never reaches here
LnNo.200        else
LnNo.201          tmp = (char *) "";
LnNo.202
LnNo.203        if (details & GST_DEBUG_GRAPH_SHOW_FULL_PARAMS) {
LnNo.204          param_name = g_strdup_printf ("%s\\n%s=%s", tmp, property->name,
LnNo.205              value_str);
LnNo.206        } else {
LnNo.207          param_name = g_strdup_printf ("%s\\n%s=%."
LnNo.208              G_STRINGIFY (PARAM_MAX_LENGTH) "s%s", tmp, property->name,
LnNo.209              value_str, ellipses);
LnNo.210        }

Removing prefixing of 'property->name' by an empty string should not make any difference.
But, if it is still changing the behaviour, please review the new patch attached in which 'property->name' is prefixed with an empty string.
Comment 16 Ashish Kumar 2017-07-31 08:56:55 UTC
(In reply to Ashish Kumar from comment #15)
> (In reply to Sebastian Dröge (slomo) from comment #13)
> > Review of attachment 356344 [details] [review] [review] [review]:
> > 
> > ::: gst/gstdebugutils.c
> > @@ +198,2 @@
> >          if (details & GST_DEBUG_GRAPH_SHOW_FULL_PARAMS) {
> > +          param_name = g_strdup_printf ("\\n%s=%s", property->name,
> > 
> > This is changing behaviour. You're not prefixing with the property_name
> > anymore. Also below
> 
> ----------------------------------
> In the original code 'property->name' is always prefixed by an empty string
> as 'tmp' is always assigned empty string ""
> ------------------
> LnNo.198        if (param_name)     //'param_name' always 'NULL' here
> LnNo.199          tmp = param_name; //control never reaches here
> LnNo.200        else
> LnNo.201          tmp = (char *) "";
> LnNo.202
> LnNo.203        if (details & GST_DEBUG_GRAPH_SHOW_FULL_PARAMS) {
> LnNo.204          param_name = g_strdup_printf ("%s\\n%s=%s", tmp,
> property->name,
> LnNo.205              value_str);
> LnNo.206        } else {
> LnNo.207          param_name = g_strdup_printf ("%s\\n%s=%."
> LnNo.208              G_STRINGIFY (PARAM_MAX_LENGTH) "s%s", tmp,
> property->name,
> LnNo.209              value_str, ellipses);
> LnNo.210        }
> 
> Removing prefixing of 'property->name' by an empty string should not make
> any difference.
> But, if it is still changing the behaviour, please review the new patch
> attached in which 'property->name' is prefixed with an empty string.

@Mr. Sebastian
Have you reviewed?
Comment 17 Sebastian Dröge (slomo) 2018-05-07 16:05:09 UTC
There's not really any bug here and this is a false positive in some static analyzer. The patch is correct but it makes the code harder to follow and does otherwise have no effect in the best case.