Fix static analysis issues

- Prevents integer overflow
- Fix memory leak

Change-Id: I3cb5e053fc2ac7659fad2fa9bb6b8e19ebc4e58c
Signed-off-by: Hwankyu Jhun <h.jhun@samsung.com>

diff --git a/src/tool/preference_tool.c b/src/tool/preference_tool.c
index 499093325cc10a084c9248379edf95f81e315d23..cbf8c2ecd9ad174dda9f083cab07211e98247aec 100644 (file)
--- a/src/tool/preference_tool.c
+++ b/src/tool/preference_tool.c
@@ -502,7 +502,10 @@ static int _print_pref_value_from_file_path(const char *path,
        double value_dbl = 0;
        char file_buf[BUF_LEN] = {0,};
        char *value_str = NULL;
-       int value_size = 0;
+       size_t value_size = 0;
+       size_t diff;
+       size_t file_buf_size;
+       char *new_value_str;
 
        fp = fopen(path, "r");
        if (fp == NULL) {
@@ -577,12 +580,20 @@ static int _print_pref_value_from_file_path(const char *path,
        case PREFERENCE_TYPE_STRING:
                while (fgets(file_buf, sizeof(file_buf), fp)) {
                        if (value_str) {
-                               value_size += strlen(file_buf);
-                               value_str = (char *)realloc(value_str,
+                               file_buf_size = strlen(file_buf);
+                               diff = INT_MAX - file_buf_size;
+                               if (value_size > diff) {
+                                       printf("Integer overflow\n");
+                                       break;
+                               }
+
+                               value_size += file_buf_size;
+                               new_value_str = (char *)realloc(value_str,
                                                value_size);
-                               if (value_str == NULL)
+                               if (new_value_str == NULL)
                                        break;
 
+                               value_str = new_value_str;
                                strncat(value_str, file_buf, strlen(file_buf));
                        } else {
                                value_size = strlen(file_buf) + 1;
@@ -654,12 +665,14 @@ static int _restore(const char *pkgid)
                        if (ret < 0) {
                                printf("create new prefer key failed (%d)\n",
                                                ret);
+                               sqlite3_finalize(stmt);
                                return -1;
                        }
                } else {
                        break;
                }
        }
+       sqlite3_finalize(stmt);
 
        return 0;
 }