Skip to content

BUG: Free the header on nifti_tool's duplicate-file failure paths - #101

Open
hjmjohnson wants to merge 1 commit into
masterfrom
pr/fix-tool-error-path-leaks
Open

hjmjohnson wants to merge 1 commit into
masterfrom
pr/fix-tool-error-path-leaks

Conversation

@hjmjohnson

Copy link
Copy Markdown
Member

Re-submission of #60, reverted from master on 2026-09-24 so it can be
reviewed before merging. Content is unchanged from the original.

Base: master. Independent: nothing has to land before it.

Commits
  • BUG: Free the header on nifti_tool's duplicate-file failure paths

Ordering for all the re-submitted work is tracked in #84.

act_mod_hdrs(), act_mod_hdr2s() and act_swap_hdrs() -- five functions
across the two tools -- read a header, then, when -prefix is given,
duplicate the dataset before writing the modified header back.  Each of
the three ways that duplication can fail returns without freeing the
header, and the last of them also loses the strdup'd duplicate name:

    nhdr = nt_read_header(fname, &nver, &swap, 0, ...);
    ...
    if( opts->prefix ) {
       nim = nt_image_read(opts, fname, 1, 1);
       if( !nim ) { fprintf(...); return 1; }              /* nhdr */
       if( nifti_set_filenames(nim, opts->prefix, 1, 1) ) {
          nifti_image_free(nim); return 1;                 /* nhdr */
       }
       dupname = nifti_strdup(nim->fname);
       if( nifti_image_write_status(nim) ) {
          nifti_image_free(nim); return 1;                 /* nhdr, dupname */
       }
    }
    ...
    free(dupname);
    free(nhdr);

The normal path frees both.  Reproduced by pointing -prefix at a
directory that cannot be written:

    nifti_tool -mod_hdr -prefix <read-only dir>/anat1 -infiles anat0.nii \
               -mod_field qoffset_x -17.325

  before:  definitely lost: 348 bytes in 1 blocks
  after:   ERROR SUMMARY: 0 errors from 0 contexts

Separately, act_diff_nims() in both tools releases the first image with
free(nim0) when reading the second one fails.  That is a shallow free: it
loses nim0's fname, iname and any data or extensions.  It now calls
nifti_image_free() like the success path six lines below.

Found by running the test suite under valgrind.  On the normal paths the
suite is clean -- 484 traced processes, no invalid access, no
uninitialised value and no leak in any nifti binary -- so these are
error-path defects that the tests do not otherwise reach.

(cherry picked from commit 40009a9)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants