libgcrypt coverity static analysis reports
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Jakuje
	Apr 7 2021, 5:15 PM

Description

the coverity scan reported couple of issues in libgcrypt. Ignoring the tests memory leaks and false positives, one looks like a real issue:

Error: RESOURCE_LEAK (CWE-772): [#def8]
libgcrypt-1.9.1/cipher/ecc-eddsa.c:997: alloc_fn: Storage is returned from allocation function "_gcry_mpi_new".
libgcrypt-1.9.1/cipher/ecc-eddsa.c:997: var_assign: Assigning: "s" = storage returned from "_gcry_mpi_new(0U)".
libgcrypt-1.9.1/cipher/ecc-eddsa.c:1006: leaked_storage: Variable "s" going out of scope leaks the storage it points to.
# 1004|       b++;
# 1005|     else
# 1006|->     return GPG_ERR_NOT_IMPLEMENTED;
# 1007|   
# 1008|     /* Encode and check the public key.  */

The patch to address this issue is attached:

libgcrypt-coverity.patch927 BDownload