[dlt-control-common] Memory Leak - It was verified by ASAN (Address Sanitizer).

[zj3t]

Hi great COVESA team, it's me again...haha..
Every weekend, I spend time studying the source code of DLT-DAEMON, and every time I do, I am struck by how impressive it is as software.

Summary

While reviewing the source code of DLT-passive-node-ctrl, I noticed many instances of memory deallocation missing the call to the free() function.
To further investigate, I used ASAN to analyze DLT-passive-node-ctrl and discovered the existence of memory leaks.

Memory Leak

Memory leak occurs even if no input value is entered.

[dlt-control-common.c]

It appears that the heap memory allocated by calloc() is not being freed.

Likewise, dlt-logstorage-ctrl is also the cause.

It seems to be done by calling the dlt_file_free() function.
As before (428b835)

END

I came to know your foundation while researching someip,
Studying dlt-daemon, I admire your skills.

It may be a minor vulnerability (bug), but I am reporting it because there is a possibility that a more competent hacker than me will exploit it later.

Thanks.
Ah! And if possible, I'd like to request a CVE.
If you guys let me, I'll make a request to MITRE.

Please let me know if you allow(Request CVE) it in response.

[michael-methner]

Hello @zj3t ,
thanks for the report. Your work is highly appreciated.
For sure you can request a CVE, but I do not know if this could be really used as an attack vector. Does this matter to the CVE?

btw: do you want to prepare a fix as well? I would be happy to merge it.

[zj3t]

Hi @michael-methner

Thanks for the reply.

Memory leaks occur when a program dynamically allocates memory, but loses track of that memory and is unable to free it, causing the memory to remain occupied even when it is no longer needed. This can result in the program using up more and more memory over time, eventually leading to the program crashing or freezing.

In this case(issue), memory leak occurs regardless of user input, so there is a possibility of becoming a problem in the future.

[zj3t]

@michael-methner

Oh!! I'm not a developer so I'm not ready to fix it.

It seems that you who understand the program well should do the modification.
Thank you for just asking me.

Later, before you merge, I'll check the patch.

Thanks :)

[lvklevankhanh]

Hi @zj3t , @michael-methner ,

The fixed version is already at #441.
Please take a look and let me know if any comment.

Thanks,

[zj3t]

Thanks @lvklevankhanh @michael-methner :)
I respect you all.
I can understand why there are many talented players in the COVESA team.

Thank you again.

[zj3t]

Miss Click....
I would be grateful if you could close the issue.

[lvklevankhanh]

Hi @zj3t ,
Thank you for your contribution.
Regards,