From ff3276ca64d20d35eba093c034647211bb5561da Mon Sep 17 00:00:00 2001 From: "Mike Stepanek (mstepane)" Date: Fri, 5 Jun 2020 18:44:07 +0000 Subject: [PATCH] Merge pull request #2242 in SNORT/snort3 from ~KATHARVE/snort3:coverity_fixes_search_engines to master Squashed commit of the following: commit 9295d4275cd1f25662f546a86b5e4f438d1262e4 Author: Katura Harvey Date: Thu Jun 4 17:11:14 2020 -0400 search_engines: fix potential memory leaks and an error in a printed value --- src/search_engines/bnfa_search.cc | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/search_engines/bnfa_search.cc b/src/search_engines/bnfa_search.cc index 4a39dc015..92d869bbb 100644 --- a/src/search_engines/bnfa_search.cc +++ b/src/search_engines/bnfa_search.cc @@ -994,6 +994,7 @@ static int _bnfa_conv_list_to_csparse_array(bnfa_struct_t* bnfa) if ( pi[k] >= nps ) { /* Fatal */ + BNFA_FREE(pi,bnfa->bnfaNumStates*sizeof(bnfa_state_t),bnfa->nextstate_memory); return -1; } @@ -1094,11 +1095,11 @@ void bnfaPrint(bnfa_struct_t* bnfa) ps_index++; /* skip state number */ cw = ps[ps_index]; /* control word */ - fb = (cw & BNFA_SPARSE_FULL_BIT)>>BNFA_SPARSE_VALUE_SHIFT; /* full storage bit */ - mb = (cw & BNFA_SPARSE_MATCH_BIT)>>BNFA_SPARSE_VALUE_SHIFT; /* matching state bit */ + fb = (cw & BNFA_SPARSE_FULL_BIT)>>BNFA_SPARSE_VALUE_SHIFT; /* full storage bit */ + mb = (cw & BNFA_SPARSE_MATCH_BIT)>>BNFA_SPARSE_VALUE_SHIFT; /* matching state bit */ nt = (cw & BNFA_SPARSE_COUNT_BITS)>>BNFA_SPARSE_VALUE_SHIFT; /* number of transitions 0-63 */ - fs = (cw & BNFA_SPARSE_MAX_STATE)>>BNFA_SPARSE_VALUE_SHIFT; /* fail state */ + fs = (cw & BNFA_SPARSE_MAX_STATE); /* fail state */ ps_index++; /* skip control word */ @@ -1277,7 +1278,7 @@ void bnfaFree(bnfa_struct_t* bnfa) bnfa->matchlist_memory); BNFA_FREE(bnfa->bnfaNextState,bnfa->bnfaNumStates*sizeof(bnfa_state_t*), bnfa->nextstate_memory); - BNFA_FREE(bnfa->bnfaTransList,(2*bnfa->bnfaNumStates+bnfa->bnfaNumTrans)*sizeof(bnfa_state_t*), + BNFA_FREE(bnfa->bnfaTransList,(2*bnfa->bnfaNumStates+bnfa->bnfaNumTrans)*sizeof(bnfa_state_t), bnfa->nextstate_memory); snort_free(bnfa); /* cannot update memory tracker when deleting bnfa so just 'free' it !*/ } -- 2.47.3