2021-05-14 18:51:06

by Steve Grubb

Subject: [Bluez PATCH 2/6 v2] Fix leaks in obex

In filesystem, g_file_get_contents allocates fresh memory to buf.
It needs to be freed after conversion to a GString object.

Destination was missed on an error path as is mld.

---
obexd/plugins/filesystem.c | 2 +-
obexd/plugins/ftp.c | 8 ++++++--
obexd/plugins/messages-dummy.c | 1 +
3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/obexd/plugins/filesystem.c b/obexd/plugins/filesystem.c
index 09bff8ad0..44e3cf3d2 100644
--- a/obexd/plugins/filesystem.c
+++ b/obexd/plugins/filesystem.c@@ -416,6 +416,7 @@ static void *capability_open(const char *name, int oflag, mode_t mode,
}

object->buffer = g_string_new(buf);
+ g_free(buf);

if (size)
*size = object->buffer->len;
diff --git a/obexd/plugins/ftp.c b/obexd/plugins/ftp.c
index 259bfcae2..4b04bab06 100644
--- a/obexd/plugins/ftp.c
+++ b/obexd/plugins/ftp.c
@@ -386,8 +386,10 @@ static int ftp_copy(struct ftp_session *ftp, const char *name,
ret = verify_path(destdir);
g_free(destdir);

- if (ret < 0)
+ if (ret < 0) {
+ g_free(destination);
return ret;
+ }

source = g_build_filename(ftp->folder, name, NULL);

@@ -424,8 +426,10 @@ static int ftp_move(struct ftp_session *ftp, const char *name,
ret = verify_path(destdir);
g_free(destdir);

- if (ret < 0)
+ if (ret < 0) {
+ g_free(destination);
return ret;
+ }

source = g_build_filename(ftp->folder, name, NULL);

diff --git a/obexd/plugins/messages-dummy.c b/obexd/plugins/messages-dummy.c
index 34199fa05..e37b52df6 100644
--- a/obexd/plugins/messages-dummy.c
+++ b/obexd/plugins/messages-dummy.c
@@ -488,6 +488,7 @@ int messages_get_messages_listing(void *session, const char *name,
int err = -errno;
DBG("fopen(): %d, %s", -err, strerror(-err));
g_free(path);
+ g_free(mld);
return -EBADR;
}
}
--
2.31.1

2021-05-15 03:19:16

by Luiz Augusto von Dentz

Subject: Re: [Bluez PATCH 2/6 v2] Fix leaks in obex

Hi Steve,

On Fri, May 14, 2021 at 11:51 AM Steve Grubb <[email protected]> wrote:
>
>
> In filesystem, g_file_get_contents allocates fresh memory to buf.
> It needs to be freed after conversion to a GString object.
>
> Destination was missed on an error path as is mld.
>
> ---
> obexd/plugins/filesystem.c | 2 +-
> obexd/plugins/ftp.c | 8 ++++++--
> obexd/plugins/messages-dummy.c | 1 +
> 3 files changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/obexd/plugins/filesystem.c b/obexd/plugins/filesystem.c
> index 09bff8ad0..44e3cf3d2 100644
> --- a/obexd/plugins/filesystem.c
> +++ b/obexd/plugins/filesystem.c@@ -416,6 +416,7 @@ static void *capability_open(const char *name, int oflag, mode_t mode,
> }
>
> object->buffer = g_string_new(buf);
> + g_free(buf);
>
> if (size)
> *size = object->buffer->len;
> diff --git a/obexd/plugins/ftp.c b/obexd/plugins/ftp.c
> index 259bfcae2..4b04bab06 100644
> --- a/obexd/plugins/ftp.c
> +++ b/obexd/plugins/ftp.c
> @@ -386,8 +386,10 @@ static int ftp_copy(struct ftp_session *ftp, const char *name,
> ret = verify_path(destdir);
> g_free(destdir);
>
> - if (ret < 0)
> + if (ret < 0) {
> + g_free(destination);
> return ret;
> + }
>
> source = g_build_filename(ftp->folder, name, NULL);
>
> @@ -424,8 +426,10 @@ static int ftp_move(struct ftp_session *ftp, const char *name,
> ret = verify_path(destdir);
> g_free(destdir);
>
> - if (ret < 0)
> + if (ret < 0) {
> + g_free(destination);
> return ret;
> + }
>
> source = g_build_filename(ftp->folder, name, NULL);
>
> diff --git a/obexd/plugins/messages-dummy.c b/obexd/plugins/messages-dummy.c
> index 34199fa05..e37b52df6 100644
> --- a/obexd/plugins/messages-dummy.c
> +++ b/obexd/plugins/messages-dummy.c
> @@ -488,6 +488,7 @@ int messages_get_messages_listing(void *session, const char *name,
> int err = -errno;
> DBG("fopen(): %d, %s", -err, strerror(-err));
> g_free(path);
> + g_free(mld);
> return -EBADR;
> }
> }
> --
> 2.31.1

You will need to resend this since apparently patchwork cannot
identify this as the same set as the others:

https://patchwork.kernel.org/project/bluetooth/list/?series=482521


--
Luiz Augusto von Dentz