Thread (2 messages) 2 messages, 2 authors, 2021-05-15

Re: [Bluez PATCH 2/6 v2] Fix leaks in obex

From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date: 2021-05-15 00:03:43

Hi Steve,

On Fri, May 14, 2021 at 11:51 AM Steve Grubb [off-list ref] wrote:
quoted hunk ↗ jump to hunk

In filesystem, g_file_get_contents allocates fresh memory to buf.
It needs to be freed after conversion to a GString object.

Destination was missed on an error path as is mld.

---
 obexd/plugins/filesystem.c     | 2 +-
 obexd/plugins/ftp.c            | 8 ++++++--
 obexd/plugins/messages-dummy.c | 1 +
 3 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/obexd/plugins/filesystem.c b/obexd/plugins/filesystem.c
index 09bff8ad0..44e3cf3d2 100644
--- a/obexd/plugins/filesystem.c
+++ b/obexd/plugins/filesystem.c@@ -416,6 +416,7 @@ static void *capability_open(const char *name, int oflag, mode_t mode,
                }

                object->buffer = g_string_new(buf);
+               g_free(buf);

                if (size)
                        *size = object->buffer->len;
diff --git a/obexd/plugins/ftp.c b/obexd/plugins/ftp.c
index 259bfcae2..4b04bab06 100644
--- a/obexd/plugins/ftp.c
+++ b/obexd/plugins/ftp.c
@@ -386,8 +386,10 @@ static int ftp_copy(struct ftp_session *ftp, const char *name,
        ret = verify_path(destdir);
        g_free(destdir);

-       if (ret < 0)
+       if (ret < 0) {
+               g_free(destination);
                return ret;
+       }

        source = g_build_filename(ftp->folder, name, NULL);
@@ -424,8 +426,10 @@ static int ftp_move(struct ftp_session *ftp, const char *name,
        ret = verify_path(destdir);
        g_free(destdir);

-       if (ret < 0)
+       if (ret < 0) {
+               g_free(destination);
                return ret;
+       }

        source = g_build_filename(ftp->folder, name, NULL);
diff --git a/obexd/plugins/messages-dummy.c b/obexd/plugins/messages-dummy.c
index 34199fa05..e37b52df6 100644
--- a/obexd/plugins/messages-dummy.c
+++ b/obexd/plugins/messages-dummy.c
@@ -488,6 +488,7 @@ int messages_get_messages_listing(void *session, const char *name,
                        int err = -errno;
                        DBG("fopen(): %d, %s", -err, strerror(-err));
                        g_free(path);
+                       g_free(mld);
                        return -EBADR;
                }
        }
--
2.31.1
You will need to resend this since apparently patchwork cannot
identify this as the same set as the others:

https://patchwork.kernel.org/project/bluetooth/list/?series=482521


-- 
Luiz Augusto von Dentz
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help