diff options
author | Barnabás Pőcze <pobrn@protonmail.com> | 2023-04-22 21:37:59 +0200 |
---|---|---|
committer | Simon McVittie <smcv@collabora.com> | 2023-05-12 18:16:47 +0000 |
commit | b5a87e214fa5cb5728bc145cedcedaa6d82bd493 (patch) | |
tree | 025f4a00162838a6bfcb4c224d73e5a8db93d936 | |
parent | a841b8ec8f43691c07313de6d1f27f6cbd82b1ca (diff) | |
download | dbus-b5a87e214fa5cb5728bc145cedcedaa6d82bd493.tar.gz |
dbus_message_iter_get_signature: Fix two memory leaks on OOM
Previously, `retstr` would not be freed when `_dbus_string_append_len()`
or `_dbus_string_steal_data()` failed.
Fix those by:
* jumping to `_dbus_string_free()` when `_dbus_string_append_len()` fails
* ignoring the return value of `_dbus_string_free()`.
The latter works because in case of failure, `ret` will be set
to NULL by `_dbus_string_steal_data()`.
Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
-rw-r--r-- | dbus/dbus-message.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/dbus/dbus-message.c b/dbus/dbus-message.c index d82e335e..b47a8638 100644 --- a/dbus/dbus-message.c +++ b/dbus/dbus-message.c @@ -2293,7 +2293,7 @@ dbus_message_iter_get_signature (DBusMessageIter *iter) { const DBusString *sig; DBusString retstr; - char *ret; + char *ret = NULL; int start, len; DBusMessageRealIter *real = (DBusMessageRealIter *)iter; @@ -2307,9 +2307,13 @@ dbus_message_iter_get_signature (DBusMessageIter *iter) if (!_dbus_string_append_len (&retstr, _dbus_string_get_const_data (sig) + start, len)) - return NULL; - if (!_dbus_string_steal_data (&retstr, &ret)) - return NULL; + goto oom; + + /* This is correct whether it succeeds or fails: on success it sets `ret`, + * and on failure it leaves `ret` set to NULL. */ + _dbus_string_steal_data (&retstr, &ret); + +oom: _dbus_string_free (&retstr); return ret; } |