Coverity 9654, 9654: Use After Free

Because vmem_free() was implemented as a macro using the ','
operator to evaluate both arguments and we performed the free
before evaluating size we would deference the free'd pointer.
To resolve the problem we just invert the ordering and evaluate
size first just as if it was evaluated by the caller when being
passed to this function.  This ensure that if the caller is
doing something reckless like performing an assignment as
part of the size argument we still perform it and it simply
doesn't get removed by the macro.  Oh course nobody should
be doing this sort of thing, but just in case.

diff --git a/include/sys/kmem.h b/include/sys/kmem.h
index cad652c918bbc0672710088e5ca244f6dc478f37..278039ec9042b9faba5079d450bcba25dd445494 100644 (file)
--- a/include/sys/kmem.h
+++ b/include/sys/kmem.h
@@ -147,7 +147,7 @@ extern void vmem_free_debug(void *ptr, size_t size);
                 memset(_ptr_, 0, (size));                                     \
         _ptr_;                                                                \
 })
-# define vmem_free(ptr, size)           (vfree(ptr), (void)(size))
+# define vmem_free(ptr, size)           ((void)(size), vfree(ptr))
 
 #endif /* DEBUG_KMEM */
 

diff --git a/libtool b/libtool
index ccefb32792adf220064a32b57fdad713acee7ef6..aeb8ab787a12a880b773d98950592e8b9b27bd14 100755 (executable)
--- a/libtool
+++ b/libtool
@@ -331,7 +331,7 @@ link_all_deplibs=unknown
 sys_lib_search_path_spec=`echo "/lib64 /usr/lib64 /usr/local/lib64" | $SED -e "s@${gcc_dir}@\${gcc_dir}@g;s@${gcc_ver}@\${gcc_ver}@g"`
 
 # Run-time system search path for libraries
-sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /usr/lib64/R/lib /usr/lib64/atlas /usr/lib64/ldapotp /usr/lib64/openmpi/1.2.6-gcc /usr/lib64/mvapich/0.9.9-1760.19chaos/gnu/gen2/lib/shared /usr/lib64/mysql /usr/lib64/octave-3.0.1 /usr/lib64/qt-3.3/lib "
+sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /usr/nvidia/lib /usr/nvidia/lib64 /usr/lib64/R/lib /usr/lib64/atlas /usr/lib64/ldapotp /usr/lib64/openmpi/1.2.6-gcc /usr/lib64/mvapich/0.9.9-1760.19chaos/gnu/gen2/lib/shared /usr/lib64/mysql /usr/lib64/octave-3.0.1 /usr/lib64/qt-3.3/lib "
 
 # Fix the shell variable $srcfile for the compiler.
 fix_srcfile_path=""
@@ -7550,7 +7550,7 @@ link_all_deplibs=unknown
 sys_lib_search_path_spec=`echo "/lib64 /usr/lib64 /usr/local/lib64" | $SED -e "s@${gcc_dir}@\${gcc_dir}@g;s@${gcc_ver}@\${gcc_ver}@g"`
 
 # Run-time system search path for libraries
-sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /usr/lib64/R/lib /usr/lib64/atlas /usr/lib64/ldapotp /usr/lib64/openmpi/1.2.6-gcc /usr/lib64/mvapich/0.9.9-1760.19chaos/gnu/gen2/lib/shared /usr/lib64/mysql /usr/lib64/octave-3.0.1 /usr/lib64/qt-3.3/lib "
+sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /usr/nvidia/lib /usr/nvidia/lib64 /usr/lib64/R/lib /usr/lib64/atlas /usr/lib64/ldapotp /usr/lib64/openmpi/1.2.6-gcc /usr/lib64/mvapich/0.9.9-1760.19chaos/gnu/gen2/lib/shared /usr/lib64/mysql /usr/lib64/octave-3.0.1 /usr/lib64/qt-3.3/lib "
 
 # Fix the shell variable $srcfile for the compiler.
 fix_srcfile_path=""
@@ -7861,7 +7861,7 @@ link_all_deplibs=unknown
 sys_lib_search_path_spec=`echo "/lib64 /usr/lib64 /usr/local/lib64" | $SED -e "s@${gcc_dir}@\${gcc_dir}@g;s@${gcc_ver}@\${gcc_ver}@g"`
 
 # Run-time system search path for libraries
-sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /usr/lib64/R/lib /usr/lib64/atlas /usr/lib64/ldapotp /usr/lib64/openmpi/1.2.6-gcc /usr/lib64/mvapich/0.9.9-1760.19chaos/gnu/gen2/lib/shared /usr/lib64/mysql /usr/lib64/octave-3.0.1 /usr/lib64/qt-3.3/lib "
+sys_lib_dlsearch_path_spec="/lib64 /usr/lib64 /usr/nvidia/lib /usr/nvidia/lib64 /usr/lib64/R/lib /usr/lib64/atlas /usr/lib64/ldapotp /usr/lib64/openmpi/1.2.6-gcc /usr/lib64/mvapich/0.9.9-1760.19chaos/gnu/gen2/lib/shared /usr/lib64/mysql /usr/lib64/octave-3.0.1 /usr/lib64/qt-3.3/lib "
 
 # Fix the shell variable $srcfile for the compiler.
 fix_srcfile_path=""