usb/140325: Missing/incorrect initialisation and memory leak in libusb10/libusb20

[Robert Jenssen]

The following reply was made to PR usb/140325; it has been noted by GNATS.

From: Robert Jenssen <robertjenssen at ozemail.com.au>
To: bug-followup at FreeBSD.org, robertjenssen at hotmail.com
Cc:  
Subject: Re: usb/140325: Missing/incorrect initialisation and memory leak in
 libusb10/libusb20
Date: Fri, 6 Nov 2009 14:42:13 +1100

 Hi,
 
 Regarding my bug report usb/140325: Missing/incorrect initialisation and memory leak in libusb10/libusb20. I revised my simple test to:
 
 #include <stdio.h>
 #include <libusb.h>
 
 int
 main(void)
 {
   libusb_context *context;
   struct libusb_device **devs;
   libusb_device_handle *handle;
   struct libusb_config_descriptor *config;
   struct libusb_device_descriptor device_desc;
   int bytes;
 #define STRLEN 128
   unsigned char str[STRLEN];
   int transferred;
   
   libusb_init(&context);
   libusb_get_device_list(context, &devs);
   libusb_get_active_config_descriptor(devs[0], &config);
   libusb_free_config_descriptor(config);
   libusb_get_device_descriptor(devs[0], &device_desc);
   libusb_open(devs[0], &handle);
   libusb_get_string_descriptor_ascii(handle,device_desc.iProduct,str,STRLEN);
   libusb_claim_interface(handle, 1);
   libusb_bulk_transfer(handle, 1, str, STRLEN, &transferred, 0);
   libusb_release_interface(handle, 1);
   libusb_close(handle);
   libusb_free_device_list(devs, 1);
   libusb_exit(context);
 
   return 0;
 }
 
 and found two additional problems:
 
 4. A jump on uninitialised occurs at libusb20.c:658 in libusb20_dev_req_string_sync():
   req.wLength = *(uint8_t *)ptr;	/* bytes */
   if (req.wLength > len) {
 To fix, zero the upper byte with:
   memset(ptr, 0, len);
 
 5. A memory leak occurs for devs[0] in the above test. devs[0]->refcnt is incremented to 3 during libusb_bulk_transfer() but not decremented on exit from that function. Consequently, devs[0] is not freed in libusb_free_device_list(). I couldn't see a quick fix for this and it's a minor memory leak (44 bytes) so I will leave it for an expert.
 
 Regards,
 
 Rob
 -- 
 Robert Jenssen <robertjenssen at ozemail.com.au>