Fix resource leaks and a typo

Signed-off-by: Ilya Pankratov <[email protected]>

Author: Ilya Pankratov

src/fids/main.c

@@ -106,9 +106,9 @@ static void file_checksum(const char *fname) {
 	}
 	else {
 		content = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
-		close(fd);
 		mmapped = 1;
 	}
+	close(fd);
 
 	unsigned char checksum[KEY_SIZE / 8];
 	blake2b(checksum, sizeof(checksum), content, size);

src/firecfg/desktop_files.c

@@ -302,6 +302,7 @@ void fix_desktop_files(const char *homedir) {
 			printf("   %s skipped: file exists\n", filename);
 			if (change_exec)
 				free(change_exec);
+			free(outname);
 			continue;
 		}
 
@@ -310,6 +311,7 @@ void fix_desktop_files(const char *homedir) {
 			fprintf(stderr, "Warning: cannot open /usr/share/applications/%s\n", filename);
 			if (change_exec)
 				free(change_exec);
+			free(outname);
 			continue;
 		}
 
@@ -319,6 +321,7 @@ void fix_desktop_files(const char *homedir) {
 			fclose(fpin);
 			if (change_exec)
 				free(change_exec);
+			free(outname);
 			continue;
 		}
 		fprintf(fpout, "# converted by firecfg\n");

src/firejail/bandwidth.c

@@ -198,6 +198,7 @@ static void read_bandwidth_file(pid_t pid) {
 
 		fclose(fp);
 	}
+	free(fname);
 }
 
 static void write_bandwidth_file(pid_t pid) {
@@ -217,6 +218,7 @@ static void write_bandwidth_file(pid_t pid) {
 			ptr = ptr->next;
 		}
 		fclose(fp);
+		free(fname);
 	}
 	else
 		goto errout;

src/firejail/fs.c

@@ -293,6 +293,7 @@ void fs_blacklist(void) {
 	while (entry) {
 		OPERATION op = OPERATION_MAX;
 		char *ptr;
+		int free_macros = 0;
 
 		// whitelist commands handled by fs_whitelist()
 		if (strncmp(entry->data, "whitelist ", 10) == 0 ||
@@ -359,6 +360,7 @@ void fs_blacklist(void) {
 				if (!enames)
 					errExit("calloc");
 				enames[0] = expand_macros(entry->data + 12);
+				free_macros = 1;
 				assert(enames[1] == 0);
 			}
 
@@ -372,6 +374,9 @@ void fs_blacklist(void) {
 				noblacklist[noblacklist_c++] = enames[i];
 			}
 
+			if (free_macros) {
+				free(enames[0]);
+			}
 			free(enames);
 
 			entry = entry->next;

src/firejail/fs_home.c

@@ -67,8 +67,10 @@ static void skel(const char *homedir) {
 		if (asprintf(&fname, "%s/.zshrc", homedir) == -1)
 			errExit("asprintf");
 		// don't copy it if we already have the file
-		if (access(fname, F_OK) == 0)
+		if (access(fname, F_OK) == 0) {
+			free(fname);
 			return;
+		}
 		if (is_link(fname)) { // access(3) on dangling symlinks fails, try again using lstat
 			fprintf(stderr, "Error: invalid %s file\n", fname);
 			exit(1);
@@ -91,8 +93,10 @@ static void skel(const char *homedir) {
 		if (asprintf(&fname, "%s/.cshrc", homedir) == -1)
 			errExit("asprintf");
 		// don't copy it if we already have the file
-		if (access(fname, F_OK) == 0)
+		if (access(fname, F_OK) == 0) {
+			free(fname);
 			return;
+		}
 		if (is_link(fname)) { // access(3) on dangling symlinks fails, try again using lstat
 			fprintf(stderr, "Error: invalid %s file\n", fname);
 			exit(1);
@@ -115,8 +119,10 @@ static void skel(const char *homedir) {
 		if (asprintf(&fname, "%s/.bashrc", homedir) == -1)
 			errExit("asprintf");
 		// don't copy it if we already have the file
-		if (access(fname, F_OK) == 0)
+		if (access(fname, F_OK) == 0) {
+			free(fname);
 			return;
+		}
 		if (is_link(fname)) { // access(3) on dangling symlinks fails, try again using lstat
 			fprintf(stderr, "Error: invalid %s file\n", fname);
 			exit(1);

src/firejail/ids.c

@@ -42,6 +42,7 @@ static void ids_init(void) {
 	if (dup(fd) != STDOUT_FILENO)
 		errExit("dup");
 	close(fd);
+	free(fname);
 
 	sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3, PATH_FIDS, "--init", cfg.homedir);
 }
@@ -63,6 +64,7 @@ static void ids_check(void) {
 	if (dup(fd) != STDIN_FILENO)
 		errExit("dup");
 	close(fd);
+	free(fname);
 
 	sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP| SBOX_ALLOW_STDIN, 3, PATH_FIDS, "--check", cfg.homedir);
 }

src/firejail/run_files.c

@@ -122,6 +122,7 @@ void set_name_run_file(pid_t pid) {
 	// mode and ownership
 	SET_PERMS_STREAM(fp, 0, 0, 0644);
 	fclose(fp);
+	free(fname);
 }
 
 
@@ -141,6 +142,7 @@ void set_x11_run_file(pid_t pid, int display) {
 	// mode and ownership
 	SET_PERMS_STREAM(fp, 0, 0, 0644);
 	fclose(fp);
+	free(fname);
 }
 
 void set_profile_run_file(pid_t pid, const char *fname) {

src/firejail/util.c

@@ -1392,6 +1392,7 @@ void enter_network_namespace(pid_t pid) {
 		fprintf(stderr, "Error: the sandbox doesn't use a new network namespace\n");
 		exit(1);
 	}
+	free(name);
 
 	// join the namespace
 	EUID_ROOT();

src/firemon/netstats.c

@@ -154,6 +154,7 @@ static void print_proc(int index, int itv, int col) {
 		// the sandbox doesn't have a --net= option, don't print
 		if (cmd)
 			free(cmd);
+		free(name);
 		return;
 	}
 
@@ -189,7 +190,7 @@ static void print_proc(int index, int itv, int col) {
 		free(cmd);
 	if (user)
 		free(user);
-
+	free(name);
 }
 
 void netstats(void) {

src/jailcheck/access.c

@@ -80,10 +80,13 @@ void access_setup(const char *directory) {
 	FILE *fp = fopen(test_file, "w");
 	if (!fp) {
 		printf("Warning: I cannot create test file in directory %s, skipping...\n", directory);
+		free(path);
+		free(test_file);
 		return;
 	}
 	fprintf(fp, "this file was created by firetest utility, you can safely delete it\n");
 	fclose(fp);
+	free(path);
 	int rv = chown(test_file, user_uid, user_gid);
 	if (rv)
 		errExit("chown");

src/jailcheck/noexec.c

@@ -55,6 +55,7 @@ void noexec_setup(void) {
 			execfile_len = s.st_size;
 			close(fd);
 		}
+		free(self);
 	}
 }
 
@@ -109,5 +110,6 @@ void noexec_test(const char *path) {
 	int status;
 	wait(&status);
 	int rv = unlink(fname);
+	free(fname);
 	(void) rv;
 }

src/jailcheck/virtual.c

@@ -49,6 +49,7 @@ void virtual_setup(const char *directory) {
 	FILE *fp = fopen(test_file, "w");
 	if (!fp) {
 		printf("Warning: I cannot create test file in directory %s, skipping...\n", directory);
+		free(test_file);
 		return;
 	}
 	fprintf(fp, "this file was created by firetest utility, you can safely delete it\n");

src/profstats/main.c

@@ -344,7 +344,7 @@ int main(int argc, char **argv) {
 		if (cnt_seccomp > (seccomp + 1))
 			cnt_seccomp = seccomp + 1;
 		if (cnt_restrict_namespaces > (restrict_namespaces + 1))
-			cnt_seccomp = restrict_namespaces + 1;
+			cnt_restrict_namespaces = restrict_namespaces + 1;
 		if (cnt_dbus_user_none > (dbususernone + 1))
 			cnt_dbus_user_none = dbususernone + 1;
 		if (cnt_dbus_user_filter > (dbususerfilter + 1))