Possible problems found by static analysis of code.

We analyzed the net-tools-1.60 code with Coverity.
Coverity is commercial enterprise level tool for
static analysis (analysis based only on compiling
of sources, not based on running of binary) of the code.

This change should fix some possible problems like resource (memory,
file descriptors) leaks.

Follow respective parts of the scan log. The line
numbers could be quite different as we analyzed Red Hat's
heavily patched version of net-tools-1.60.

Error: RESOURCE_LEAK
ipmaddr.c:191: alloc_fn: Calling allocation function "malloc".
ipmaddr.c:191: var_assign: Assigning: "ma" =  storage returned from "malloc(sizeof (m) /*64*/)".
ipmaddr.c:203: overwrite_var: Overwriting "ma" in call "ma = malloc(sizeof (m) /*64*/)" leaks the storage that "ma" points to.

Error: RESOURCE_LEAK
iptunnel.c:473: alloc_fn: Calling allocation function "fopen".
iptunnel.c:473: var_assign: Assigning: "fp" =  storage returned from "fopen("/proc/net/dev", "r")".
iptunnel.c:488: leaked_storage: Variable "fp" going out of scope leaks the storage it points to.
iptunnel.c:524: leaked_storage: Variable "fp" going out of scope leaks the storage it points to.

Error: FORWARD_NULL
lib/inet.c:408: var_compare_op: Comparing "item" to null implies that "item" might be null.
lib/inet.c:410: var_deref_op: Dereferencing null variable "item".

Error: RESOURCE_LEAK
lib/masq_info.c:174: alloc_fn: Calling allocation function "malloc".
lib/masq_info.c:174: var_assign: Assigning: "mslist" =  storage returned from "malloc(1152UL)".
lib/masq_info.c:215: leaked_storage: Variable "mslist" going out of scope leaks the storage it points to.

Error: RESOURCE_LEAK
lib/netrom_gr.c:35: alloc_fn: Calling allocation function "fopen".
lib/netrom_gr.c:35: var_assign: Assigning: "f1" =  storage returned from "fopen("/proc/net/nr_nodes", "r")".
lib/netrom_gr.c:42: overwrite_var: Overwriting "f1" in call "f1 = fopen("/proc/net/nr_nodes", "r")" leaks the storage that "f1" points to.

Error: RESOURCE_LEAK
lib/netrom_gr.c:36: alloc_fn: Calling allocation function "fopen".
lib/netrom_gr.c:36: var_assign: Assigning: "f2" =  storage returned from "fopen("/proc/net/nr_neigh", "r")".
lib/netrom_gr.c:44: overwrite_var: Overwriting "f2" in call "f2 = fopen("/proc/net/nr_neigh", "r")" leaks the storage that "f2" points to

Error: FORWARD_NULL
lib/x25.c:101: var_compare_op: Comparing "p" to null implies that "p" might be null.
lib/x25.c:109: var_deref_op: Dereferencing null variable "p".

Error: RESOURCE_LEAK
nameif.c:166: alloc_fn: Calling allocation function "xmalloc".
nameif.c:166: var_assign: Assigning: "ch" =  storage returned from "xmalloc(sizeof (struct change) /*40*/)".
nameif.c:177: leaked_storage: Variable "ch" going out of scope leaks the storage it points to.

Error: NEGATIVE_RETURNS
netstat.c:463: negative_return_fn: Function "readlink(line, lname, 29UL)" returns a negative number.
netstat.c:463: var_assign: Assigning: signed variable "lnamelen" = "readlink".
netstat.c:464: negative_returns: Using variable "lnamelen" as an index to array "lname".

Error: RESOURCE_LEAK
netstat.c:894: alloc_fn: Calling allocation function "fopen".
netstat.c:894: var_assign: Assigning: "f" =  storage returned from "fopen("/proc/net/x25", "r")".
netstat.c:905: overwrite_var: Overwriting "f" in call "f = fopen("/proc/net/x25", "r")" leaks the storage that "f" points to.

Error: RESOURCE_LEAK
netstat.c:1916: alloc_fn: Calling allocation function "fopen".
netstat.c:1916: var_assign: Assigning: "f" =  storage returned from "fopen("/proc/net/ipx", "r")".
netstat.c:1934: leaked_storage: Variable "f" going out of scope leaks the storage it points to.
netstat.c:1947: leaked_storage: Variable "f" going out of scope leaks the storage it points to.
netstat.c:1957: leaked_storage: Variable "f" going out of scope leaks the storage it points to.

1 files changed, 2 insertions, 1 deletions

diff --git a/nameif.c b/nameif.c
index 27fcbb4..c77c4fe 100644
--- a/nameif.c
+++ b/nameif.c
@@ -153,6 +153,7 @@ void readconf(void)
 	FILE *ifh;
 	char *p;
 	int n;
+	struct change *ch = NULL;
 
 	ifh = fopen(fname, "r");
 	if (!ifh) 
@@ -162,7 +163,6 @@ void readconf(void)
 	linel = 0;
 	linenum = 1; 
 	while (getdelim(&line, &linel, '\n', ifh) > 0) {
-		struct change *ch = xmalloc(sizeof(struct change)); 
 		char pos[20]; 
 
 		sprintf(pos, _("line %d"), linenum); 
@@ -177,6 +177,7 @@ void readconf(void)
 		n = strcspn(p, " \t"); 
 		if (n > IFNAMSIZ-1) 
 			complain(_("interface name too long at line %d"), line);  
+		ch = xmalloc(sizeof(struct change));
 		memcpy(ch->ifname, p, n); 
 		ch->ifname[n] = 0; 
 		p += n;