yubico-piv-tool icon indicating copy to clipboard operation
yubico-piv-tool copied to clipboard

[ykcs11/tests] fix use-after-free warning in gcc 12

Open fuhry opened this issue 3 years ago • 3 comments

gcc 12 includes a new -Wuse-after-free warning mode that detects use of variables after a call to free(). While the use of this variable is not in fact a use-after-free, it is more correct to not reuse the dec variable or explicitly set it to NULL after calling free.

This is not a security bug.

Signed-Off-By: Dan Fuhry [email protected]

fuhry avatar Jun 16 '22 19:06 fuhry

That looks like just one out of many such instances in the code. Was that the only warning ?

qpernil avatar Jun 20 '22 12:06 qpernil

That was the only warning, yes.

fuhry avatar Jul 02 '22 22:07 fuhry

I'm a little doubtful about fixing just this one instance, to me it seems a little random that the compiler only warns about that one, particularly when it seems to me it should be able to pick up that the variable is assigned to (just not explicitly null) before being used again. I do agree re-using like this is perhaps a bit error-prone, but I also understand it from the point of view of not introducing unnecessary variables.. Anyway, this feature of gcc 12 seems a bit flaky, it should find many more of those warnings it seems to me. What about line 1157 in the same function for example? Even if it only warns once per variable it should get that one after your fix, don't you think ?

Of course, one can take the pragmatic stance and just fix any warnings and leave it at at that. But I would prefer us to consistently fix this kind of thing if we do it at all.

qpernil avatar Jul 05 '22 07:07 qpernil

I'll merge this one anyway since it's such a small change

qpernil avatar Aug 29 '22 09:08 qpernil