From: Mike Stepanek (mstepane) <mstepane@cisco.com>
Date: Fri, 5 Jun 2020 18:44:07 +0000 (+0000)
Subject: Merge pull request #2242 in SNORT/snort3 from ~KATHARVE/snort3:coverity_fixes_search_... 
X-Git-Tag: 3.0.1-5~21
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ff3276ca64d20d35eba093c034647211bb5561da;p=thirdparty%2Fsnort3.git

Merge pull request #2242 in SNORT/snort3 from ~KATHARVE/snort3:coverity_fixes_search_engines to master

Squashed commit of the following:

commit 9295d4275cd1f25662f546a86b5e4f438d1262e4
Author: Katura Harvey <katharve@cisco.com>
Date:   Thu Jun 4 17:11:14 2020 -0400

    search_engines: fix potential memory leaks and an error in a printed value
---

diff --git a/src/search_engines/bnfa_search.cc b/src/search_engines/bnfa_search.cc
index 4a39dc015..92d869bbb 100644
--- a/src/search_engines/bnfa_search.cc
+++ b/src/search_engines/bnfa_search.cc
@@ -994,6 +994,7 @@ static int _bnfa_conv_list_to_csparse_array(bnfa_struct_t* bnfa)
         if ( pi[k] >= nps )
         {
             /* Fatal */
+            BNFA_FREE(pi,bnfa->bnfaNumStates*sizeof(bnfa_state_t),bnfa->nextstate_memory);
             return -1;
         }
 
@@ -1094,11 +1095,11 @@ void bnfaPrint(bnfa_struct_t* bnfa)
             ps_index++; /* skip state number */
 
             cw = ps[ps_index]; /* control word  */
-            fb = (cw &  BNFA_SPARSE_FULL_BIT)>>BNFA_SPARSE_VALUE_SHIFT;  /* full storage bit */
-            mb = (cw &  BNFA_SPARSE_MATCH_BIT)>>BNFA_SPARSE_VALUE_SHIFT; /* matching state bit */
+            fb = (cw &  BNFA_SPARSE_FULL_BIT)>>BNFA_SPARSE_VALUE_SHIFT;   /* full storage bit */
+            mb = (cw &  BNFA_SPARSE_MATCH_BIT)>>BNFA_SPARSE_VALUE_SHIFT;  /* matching state bit */
             nt = (cw &  BNFA_SPARSE_COUNT_BITS)>>BNFA_SPARSE_VALUE_SHIFT; /* number of transitions
                                                                             0-63 */
-            fs = (cw &  BNFA_SPARSE_MAX_STATE)>>BNFA_SPARSE_VALUE_SHIFT; /* fail state */
+            fs = (cw &  BNFA_SPARSE_MAX_STATE);                           /* fail state */
 
             ps_index++;  /* skip control word */
 
@@ -1277,7 +1278,7 @@ void bnfaFree(bnfa_struct_t* bnfa)
         bnfa->matchlist_memory);
     BNFA_FREE(bnfa->bnfaNextState,bnfa->bnfaNumStates*sizeof(bnfa_state_t*),
         bnfa->nextstate_memory);
-    BNFA_FREE(bnfa->bnfaTransList,(2*bnfa->bnfaNumStates+bnfa->bnfaNumTrans)*sizeof(bnfa_state_t*),
+    BNFA_FREE(bnfa->bnfaTransList,(2*bnfa->bnfaNumStates+bnfa->bnfaNumTrans)*sizeof(bnfa_state_t),
         bnfa->nextstate_memory);
     snort_free(bnfa);   /* cannot update memory tracker when deleting bnfa so just 'free' it !*/
 }