The stdarg(3) manpage states:
va_end()
Each invocation of va_start() must be matched by a cor‐
responding invocation of va_end() in the *same function*.
After the call va_end(ap) the variable ap is *undefined*.
Multiple traversals of the list, each bracketed by
va_start() and va_end() are possible. va_end() may be
a macro or a function.
(Emphasis mine)
However, va_start(3) was not called in this function, and
callers of mowgli_argstack_create_from_va_list() also call
va_end(3) after it returns. This means both that the varargs
will always be cleaned up, and if the function ran into an
error, it would erroneously clean it up and then the caller
would be invoking va_end(3) on an uninitialized list.
This was found by the Clang static analyzer while performing
an analysis on Atheme IRC Services.
e->type = MOWGLI_ARG_BOOLEAN;
break;
default:
- va_end(va);
mowgli_object_unref(out);
mowgli_log_warning("invalid description");
return NULL;