[GH-ISSUE #4297] CI is broken (yet again) #2612

New issue

Closed

opened 2026-05-05 09:16:48 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:16:48 -06:00

Owner

Originally created by @kmk3 on GitHub (May 23, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4297

It looks like it was broken by #4229. Workflow run:

https://github.com/netblue30/firejail/runs/2534847161

Log excerpt

gcc-10 -g -O2 -ggdb -W -Wall -Werror -O2 -DVERSION='"0.9.65"'  -DPREFIX='"/usr"' -DSYSCONFDIR='"/etc/firejail"' -DLIBDIR='"/usr/lib"' -DBINDIR='"/usr/bin"'  -DHAVE_OUTPUT -DHAVE_X11 -DHAVE_PRIVATE_HOME -DHAVE_APPARMOR  -DHAVE_USERTMPFS -DHAVE_DBUSPROXY -DHAVE_FIRETUNNEL -DHAVE_GLOBALCFG -DHAVE_CHROOT -DHAVE_NETWORK -DHAVE_USERNS -DHAVE_FILE_TRANSFER -DHAVE_WHITELIST -DHAVE_SELINUX  -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security -fstack-clash-protection -fstack-protector-strong -fanalyzer   -c fs_whitelist.c -o fs_whitelist.o
In function ‘tmpfs_topdirs’:
fs_whitelist.c:398:1: error: leak of ‘topdirs’ [CWE-401] [-Werror=analyzer-malloc-leak]
  398 | }
      | ^
  ‘fs_whitelist’: events 1-4
    |
    |  523 | void fs_whitelist(void) {
    |      |      ^~~~~~~~~~~~
    |      |      |
    |      |      (1) entry to ‘fs_whitelist’
    |  524 |  ProfileEntry *entry = cfg.profile;
    |  525 |  if (!entry)
    |      |     ~ 
    |      |     |
    |      |     (2) following ‘false’ branch (when ‘entry’ is non-NULL)...
    |......
    |  528 |  if (asprintf(&runuser, "/run/user/%u", getuid()) == -1)
    |      |  ~~ ~ 
    |      |  |  |
    |      |  |  (4) following ‘false’ branch...
    |      |  (3) ...to here
    |
  ‘fs_whitelist’: event 5
    |
    |../include/common.h:39:164:
    |   39 | #define errExit(msg)    do { char msgout[500]; snprintf(msgout, 500, "Error %s: %s:%d %s", msg, __FILE__, __LINE__, __FUNCTION__); perror(msgout); exit(1);} while (0)
    |      |                                                                                                                                                                    ^
    |      |                                                                                                                                                                    |
    |      |                                                                                                                                                                    (5) ...to here
fs_whitelist.c:529:3: note: in expansion of macro ‘errExit’
    |  529 |   errExit("asprintf");
    |      |   ^~~~~~~
    |
  ‘fs_whitelist’: event 6
    |
    |  536 |  if (nowhitelist == NULL)
    |      |     ^
    |      |     |
    |      |     (6) following ‘false’ branch (when ‘nowhitelist’ is non-NULL)...
    |
  ‘fs_whitelist’: event 7
    |
    |../include/common.h:39:164:
    |   39 | #define errExit(msg)    do { char msgout[500]; snprintf(msgout, 500, "Error %s: %s:%d %s", msg, __FILE__, __LINE__, __FUNCTION__); perror(msgout); exit(1);} while (0)
    |      |                                                                                                                                                                    ^
    |      |                                                                                                                                                                    |
    |      |                                                                                                                                                                    (7) ...to here

Link to the previous issue: #4256

Cc: @glitsj16 @netblue30 @reinerh @rusty-snake @smitsohu (as participants
of #4229/#4256)

Originally created by @kmk3 on GitHub (May 23, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4297 It looks like it was broken by #4229. Workflow run: * <https://github.com/netblue30/firejail/runs/2534847161> <details> <summary>Log excerpt</summary> <p> ``` gcc-10 -g -O2 -ggdb -W -Wall -Werror -O2 -DVERSION='"0.9.65"' -DPREFIX='"/usr"' -DSYSCONFDIR='"/etc/firejail"' -DLIBDIR='"/usr/lib"' -DBINDIR='"/usr/bin"' -DHAVE_OUTPUT -DHAVE_X11 -DHAVE_PRIVATE_HOME -DHAVE_APPARMOR -DHAVE_USERTMPFS -DHAVE_DBUSPROXY -DHAVE_FIRETUNNEL -DHAVE_GLOBALCFG -DHAVE_CHROOT -DHAVE_NETWORK -DHAVE_USERNS -DHAVE_FILE_TRANSFER -DHAVE_WHITELIST -DHAVE_SELINUX -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security -fstack-clash-protection -fstack-protector-strong -fanalyzer -c fs_whitelist.c -o fs_whitelist.o In function ‘tmpfs_topdirs’: fs_whitelist.c:398:1: error: leak of ‘topdirs’ [CWE-401] [-Werror=analyzer-malloc-leak] 398 | } | ^ ‘fs_whitelist’: events 1-4 | | 523 | void fs_whitelist(void) { | | ^~~~~~~~~~~~ | | | | | (1) entry to ‘fs_whitelist’ | 524 | ProfileEntry *entry = cfg.profile; | 525 | if (!entry) | | ~ | | | | | (2) following ‘false’ branch (when ‘entry’ is non-NULL)... |...... | 528 | if (asprintf(&runuser, "/run/user/%u", getuid()) == -1) | | ~~ ~ | | | | | | | (4) following ‘false’ branch... | | (3) ...to here | ‘fs_whitelist’: event 5 | |../include/common.h:39:164: | 39 | #define errExit(msg) do { char msgout[500]; snprintf(msgout, 500, "Error %s: %s:%d %s", msg, __FILE__, __LINE__, __FUNCTION__); perror(msgout); exit(1);} while (0) | | ^ | | | | | (5) ...to here fs_whitelist.c:529:3: note: in expansion of macro ‘errExit’ | 529 | errExit("asprintf"); | | ^~~~~~~ | ‘fs_whitelist’: event 6 | | 536 | if (nowhitelist == NULL) | | ^ | | | | | (6) following ‘false’ branch (when ‘nowhitelist’ is non-NULL)... | ‘fs_whitelist’: event 7 | |../include/common.h:39:164: | 39 | #define errExit(msg) do { char msgout[500]; snprintf(msgout, 500, "Error %s: %s:%d %s", msg, __FILE__, __LINE__, __FUNCTION__); perror(msgout); exit(1);} while (0) | | ^ | | | | | (7) ...to here ``` </p> </details> Link to the previous issue: #4256 Cc: @glitsj16 @netblue30 @reinerh @rusty-snake @smitsohu (as participants of #4229/#4256)

gitea-mirror closed this issue

2026-05-05 09:16:48 -06:00

gitea-mirror commented

2026-05-05 09:16:50 -06:00

Author

Owner

@reinerh commented on GitHub (May 23, 2021):

I just checked this error and can confirm that it is a false positive by GCC 10.
When rebuilding the same file (fs_whitelist.c) with GCC 11, it no longer detects a memory leak and builds it successfully.

Unfortunately there are new warnings with GCC 11 (see #4274).

@reinerh commented on GitHub (May 23, 2021): I just checked this error and can confirm that it is a false positive by GCC 10. When rebuilding the same file (`fs_whitelist.c`) with GCC 11, it no longer detects a memory leak and builds it successfully. Unfortunately there are new warnings with GCC 11 (see #4274).

gitea-mirror commented

2026-05-05 09:16:51 -06:00

Author

Owner

@kmk3 commented on GitHub (May 23, 2021):

@reinerh @smitsohu Thanks for the quick fixes!

@kmk3 commented on GitHub (May 23, 2021): @reinerh @smitsohu Thanks for the quick fixes!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2612

No description provided.

Rows
Columns