Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210514095905.59358796@ivy-bridge>
In-Reply-To: <20210514095905.59358796@ivy-bridge>
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date:   Fri, 14 May 2021 17:03:28 -0700
Message-ID: <CABBYNZK7m=t2ExO5fZwfr0oosx8pUEQy4dOKT5HrpD_iLwqPPQ@mail.gmail.com>
Subject: Re: [Bluez PATCH 2/6 v2] Fix leaks in obex
To:     Steve Grubb <sgrubb@redhat.com>
Cc:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hi Steve,

On Fri, May 14, 2021 at 11:51 AM Steve Grubb <sgrubb@redhat.com> wrote:
>
>
> In filesystem, g_file_get_contents allocates fresh memory to buf.
> It needs to be freed after conversion to a GString object.
>
> Destination was missed on an error path as is mld.
>
> ---
>  obexd/plugins/filesystem.c     | 2 +-
>  obexd/plugins/ftp.c            | 8 ++++++--
>  obexd/plugins/messages-dummy.c | 1 +
>  3 files changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/obexd/plugins/filesystem.c b/obexd/plugins/filesystem.c
> index 09bff8ad0..44e3cf3d2 100644
> --- a/obexd/plugins/filesystem.c
> +++ b/obexd/plugins/filesystem.c@@ -416,6 +416,7 @@ static void *capability_open(const char *name, int oflag, mode_t mode,
>                 }
>
>                 object->buffer = g_string_new(buf);
> +               g_free(buf);
>
>                 if (size)
>                         *size = object->buffer->len;
> diff --git a/obexd/plugins/ftp.c b/obexd/plugins/ftp.c
> index 259bfcae2..4b04bab06 100644
> --- a/obexd/plugins/ftp.c
> +++ b/obexd/plugins/ftp.c
> @@ -386,8 +386,10 @@ static int ftp_copy(struct ftp_session *ftp, const char *name,
>         ret = verify_path(destdir);
>         g_free(destdir);
>
> -       if (ret < 0)
> +       if (ret < 0) {
> +               g_free(destination);
>                 return ret;
> +       }
>
>         source = g_build_filename(ftp->folder, name, NULL);
>
> @@ -424,8 +426,10 @@ static int ftp_move(struct ftp_session *ftp, const char *name,
>         ret = verify_path(destdir);
>         g_free(destdir);
>
> -       if (ret < 0)
> +       if (ret < 0) {
> +               g_free(destination);
>                 return ret;
> +       }
>
>         source = g_build_filename(ftp->folder, name, NULL);
>
> diff --git a/obexd/plugins/messages-dummy.c b/obexd/plugins/messages-dummy.c
> index 34199fa05..e37b52df6 100644
> --- a/obexd/plugins/messages-dummy.c
> +++ b/obexd/plugins/messages-dummy.c
> @@ -488,6 +488,7 @@ int messages_get_messages_listing(void *session, const char *name,
>                         int err = -errno;
>                         DBG("fopen(): %d, %s", -err, strerror(-err));
>                         g_free(path);
> +                       g_free(mld);
>                         return -EBADR;
>                 }
>         }
> --
> 2.31.1

You will need to resend this since apparently patchwork cannot
identify this as the same set as the others:

https://patchwork.kernel.org/project/bluetooth/list/?series=482521


-- 
Luiz Augusto von Dentz