Security: DoS vulnerability in function createDB()

[UVScan]

Affected components

affected source code file: external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c

Attack vector(s)

Missing sqlite3_free after sqlite3_exec.
To avoid memory leaks, the application should invoke sqlite3_free() on error message strings returned through the 5th parameter of sqlite3_exec() after the error message string is no longer needed.

Suggested description of the vulnerability for use in the CVE

DoS vulnerability in createDB() function in Samsung Electronics TizenRT latest version (and earlier) due to missing sqlite3_free after sqlite3_exec.

Discoverer(s)/Credits

UVScan

Reference(s)

https://www.sqlite.org/c3ref/exec.html

TizenRT/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c

Line 103 in f8f776d

result = sqlite3_exec(g_db, PDM_CREATE_T_DEVICE_LIST, NULL, NULL, NULL);

TizenRT/external/iotivity/iotivity_1.2-rel/resource/csdk/security/provisioning/src/provisioningdatabasemanager.c

Line 107 in f8f776d

result = sqlite3_exec(g_db, PDM_CREATE_T_DEVICE_LINK, NULL, NULL, NULL);