libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
F437CAE0-7C2D-441D-8122-6E621F5D1DA4
1.0.2
cpe:2.3:a:freerdp:freerdp:1.1.0:beta:*:*:*:*:*:*
848192C5-86DA-4CEE-B5BA-50739D48042C
cpe:2.3:a:freerdp:freerdp:1.1.0:beta1:*:*:*:*:*:*
C041C9F2-173A-41F4-B965-EA75FF949914
cpe:2.3:a:freerdp:freerdp:2.0.0:beta1:*:*:*:*:*:*
713589FE-376E-4E66-8282-66324EDF8264
cpe:2.3:a:freerdp:freerdp:2.0.0:rc0:*:*:*:*:*:*
C9D8EB00-9004-4493-BC51-E8E1E0F5B83A
cpe:2.3:a:freerdp:freerdp:2.0.0:rc1:*:*:*:*:*:*
F226993C-3AB8-4F86-8591-40CAAC8DD73E
cpe:2.3:a:freerdp:freerdp:2.0.0:rc2:*:*:*:*:*:*
985D90BF-3B2B-4A3C-B698-DBCB0241B95B
cpe:2.3:a:freerdp:freerdp:2.0.0:rc3:*:*:*:*:*:*
7C4656D2-EEC4-4871-BA0F-76F760526B1B
cpe:2.3:a:freerdp:freerdp:2.0.0:rc4:*:*:*:*:*:*
72638FED-C111-4E4E-B32F-B040F744F5D7
OR
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
F1E78106-58E6-4D59-990F-75DA575BFAD9
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
B620311B-34A3-48A6-82DF-6F078D7A4493
OR
Dear FreeRDP,
  I would like to report a potential memory leak on FreeRDP.

  The problem occurs on the way realloc is being used. When a size
bigger than the chunk that wants to be reallocated is passed, realloc
try to malloc a  bigger size, however in the case that malloc fails
(for example, by forcing a big allocation)  realloc will return NULL.

According to the man page:
"The realloc() function returns a pointer to the newly allocated
memory, which is suitably aligned for any built-in type and may be
different from ptr,  or  NULL  if  the  request fails.   If size was
equal to 0, either NULL or a pointer suitable to be passed to free()
is returned.  If realloc() fails, the original block is left
untouched; it is  not  freed or moved."

The problem occurs when the memory ptr passed to the first argument of
realloc is the same as the one used for the result, for example in
this case:

libfreerdp/codec/region.c
(470) int allocSize = sizeof(REGION16_DATA) + (finalNbRects * sizeof(RECTANGLE_16));
(471)  region->data = realloc(region->data, allocSize);

If the malloc inside that realloc fails, then the original memory
chunk will never be free but since realloc will return NULL, the
pointer to that memory chunk will be lost and a memory leak will
occur.

We found other 9 cases, all could be found here:
https://lgtm.com/query/8334994658751916283/

(The case where xrealloc should be disregarded since abort is being called on fail) 

Best Regards,
Nico Waisman
Semmle Security Team


Potential Memory Leaks on FreeRDP
This is a GitHub Issue
repo:FreeRDP
owner:FreeRDP
Title : Potential Memory Leaks on FreeRDP
Issue date:

--- start body ---
Dear FreeRDP,
  I would like to report a potential memory leak on FreeRDP.

  The problem occurs on the way realloc is being used. When a size
bigger than the chunk that wants to be reallocated is passed, realloc
try to malloc a  bigger size, however in the case that malloc fails
(for example, by forcing a big allocation)  realloc will return NULL.

According to the man page:
"The realloc() function returns a pointer to the newly allocated
memory, which is suitably aligned for any built-in type and may be
different from ptr,  or  NULL  if  the  request fails.   If size was
equal to 0, either NULL or a pointer suitable to be passed to free()
is returned.  If realloc() fails, the original block is left
untouched; it is  not  freed or moved."

The problem occurs when the memory ptr passed to the first argument of
realloc is the same as the one used for the result, for example in
this case:

libfreerdp/codec/region.c
(470) int allocSize = sizeof(REGION16_DATA) + (finalNbRects * sizeof(RECTANGLE_16));
(471)  region->data = realloc(region->data, allocSize);

If the malloc inside that realloc fails, then the original memory
chunk will never be free but since realloc will return NULL, the
pointer to that memory chunk will be lost and a memory leak will
occur.

We found other 9 cases, all could be found here:
https://lgtm.com/query/8334994658751916283/

(The case where xrealloc should be disregarded since abort is being called on fail) 

Best Regards,
Nico Waisman
Semmle Security Team


--- end body ---

comments :
--- start comments ---

--- end comments ---