MySQL Bugs: #97456: Memory leak at corner cases in authentication

Bug #97456	Memory leak at corner cases in authentication_win and storage ndb engine
Submitted:	1 Nov 2019 14:44	Modified:	15 Nov 2019 1:24
Reporter:	Xing Ai (OCA)	Email Updates:
Status:	Verified	Impact on me:	None
Category:	MySQL Server: Memcached	Severity:	S3 (Non-critical)
Version:	8.0	OS:	Any
Assigned to:		CPU Architecture:	Any

Description:
The two memory leak problems were found for corner cases through code review instead of testing.
Please ignore the ticket if the problems are actually fixed but the fixed code are not published yet.

1. In source file: https://github.com/mysql/mysql-server/blob/8.0/libmysql/authentication_win/common.cc ,
   When res is 0 which indicates error and the function returns NULL, memory leak happens in variable "buf".
	  Line 378:   // res is 0 which indicates error
	  Line 440:   // res is 0 which indicates error
	  
2. In source file: https://github.com/mysql/mysql-server/blob/8.0/storage/ndb/memcache/src/ndb_engine.cc ,
   When function call "default_engine_create_instance()" fails and does not return "ENGINE_SUCCESS", variable has no value assigned.
   This would cause variable "ndb_eng" has memory leak. 
   Line 161: if(return_status == ENGINE_SUCCESS)
               *handle = (ENGINE_HANDLE*) &ndb_eng->engine;

How to repeat:
The two memory leak problems were found for corner cases through code review instead of testing.

Suggested fix:
1. Possibly add codes at lines 390 and 451:
   free(buf);

2. Add code below at line 163:
   else
      free(ndb_eng);

Hi,

Thanks for the report. I reviewed the code and looks like you are correct. 

In order to submit contributions you must first sign the Oracle Contribution Agreement (OCA).
For additional information please check http://www.oracle.com/technetwork/community/oca-486395.html.
If you have any questions, please contact the MySQL community team. 
https://bugs.mysql.com/bug.php?id=97456&contribs=1

Thank you for looking in the bug report. 
Actually I have signed the Oracle Contribution Agreement (OCA).