Memory leaks in src/libvncserver/rfbserver.c, src/libvncserver/sockets.c, src/libvncserver/rfbserver.c

[shaue188]

Additional context

Our company uses libvncserver in our product. I am working on static analysis, and one of my tasks was to scan libvncserver package. During the scan, I found some errors in code:

Describe errors

1. https://github.com/LibVNC/libvncserver/blob/master/src/libvncserver/rfbserver.c#L1409
   Handle dirp is created by calling function 'opendir' and lost at https://github.com/LibVNC/libvncserver/blob/master/src/libvncserver/rfbserver.c#L1415, need closedir(dirp) there.

2. https://github.com/LibVNC/libvncserver/blob/master/src/libvncserver/sockets.c#L1211
   Handle 'sock' is created by calling function 'socket' and lost at https://github.com/LibVNC/libvncserver/blob/master/src/libvncserver/sockets.c#L1216 and https://github.com/LibVNC/libvncserver/blob/master/src/libvncserver/sockets.c#L1219, need close(sock) there.

3. https://github.com/LibVNC/libvncserver/blob/master/src/libvncserver/rfbserver.c#L347
   Dynamic memory, referenced by 'cl->host', is allocated by calling function 'strdup' and lost at https://github.com/LibVNC/libvncserver/blob/master/src/libvncserver/rfbserver.c#L364, possibly need rfbCloseClient(cl) there

[bk138]

Thanks for spotting - happy about one or three PRs!

[marcofortina]

I opened a PR for this issue:

#709

It addresses the three static-analysis cleanup paths listed here:

• closes the directory/search handle if the initial directory response send fails;
• returns RFB_INVALID_SOCKET after closing a socket when restoring blocking mode fails;
• releases the partially initialized client allocation, host string, and scaled-screen reference if rfbSetNonBlocking() fails while accepting a new TCP client.

Local validation completed:

100% tests passed, 0 tests failed out of 5