Bad free() in WaveWeakContainer.m about kismac2 HOT 7 CLOSED

_data[iv[2]] = malloc(sizeof(_data)): Result of 'malloc' is converted to a pointer of type 'UInt8 ', which is incompatible with sizeof operand type 'UInt8 *[256]'

memset((_data[iv[2]])[iv[1]], 0, 3_sizeof(UInt8)_LAST_BIT): Potential leak of memory pointed to by 'obj'

from kismac2.

I didn't get those errors, but I was wondering about it...

_data is UInt8 **[256], so _data[iv[2]] is UInt8 ** - OK, I see where the warning comes from and I suppose the sizeof(iv[2]) avoided it.

It should really be malloc(sizeof(UInt8 *)*LAST_BIT) to get an array of 256 Uint8 *.

There is no memory leak of obj, it is freed in dealloc: free((_data[x])[y]), but even eliminating 'obj' doesn't fix the false positive.

Treating malloc failures the same and cleaning up the mix of nil/NULL, I think it should be:

- (void)setBytes:(const UInt8*)bytes forIV:(const UInt8*)iv
{
    UInt8 *d;
    if (_data[iv[2]] == NULL)
    {
        _data[iv[2]] = malloc(sizeof(UInt8 *)*LAST_BIT);
        if(_data[iv[2]] == NULL)
        {
            DBNSLog(@"malloc failed");
            return;
        }
        memset(_data[iv[2]], 0, sizeof(UInt8 *)*LAST_BIT);
    }

    if ((_data[iv[2]])[iv[1]] == NULL)
    {
        (_data[iv[2]])[iv[1]] = malloc(3*sizeof(UInt8)*LAST_BIT);
        if ((_data[iv[2]])[iv[1]] == NULL) {
            DBNSLog(@"malloc failed");
            return;
        }
        memset((_data[iv[2]])[iv[1]], 0, 3*sizeof(UInt8)*LAST_BIT);
    }

    d = &((_data[iv[2]])[iv[1]])[iv[0] * 3];
    // no point setting up memcpy for 2 bytes
    d[1] = bytes[0];
    d[2] = bytes[1];

    if (d[0] == 0)
    {
        d[0] = 1;
        ++_count;
    } 
}

from kismac2.

menu Product -> Analyze

from kismac2.

Right. I made my last comment after running Analyze.

It fixed the incompatible size warning, but still had the false positive "Potential memory leak".

As far as I can see, the data structure is implementing a sparse version of

UInt8 _data[256][256][256][3];

indexed as follows:

UInt8 iv0 = iv[0], iv1 = iv[1], iv2 = iv[2]; // for readability
UInt8 *d = _data[iv2][iv1][iv0];
d[0] = 1; // once only
d[1] = bytes[0];
d[2] = bytes[1];

The actual indexing:

    d = &((_data[iv[2]])[iv[1]])[iv[0] * 3];

implies that the data structure is actually:

UInt8 _data[256][256][256*3];

which is what my latest code implemented.

from kismac2.

could you make pull request?

from kismac2.

I will do it tonight - the code is at home.

from kismac2.

Fixed: 73ce3b0

from kismac2.