D-Bus: Fix P2P DeleteService dict iteration

The previous implementation assumed the first entry coming out from the
dict is always service_type. That may not be the case, so properly
iterate over all dict entries in one loop instead of assuming what the
first entry is.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/dbus/dbus_new_handlers_p2p.c b/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
index 2f00b2488a4d683e07e0ea4448edd217af45767e..8cdd885644afdf17fc18510dd8c5de6839315c0b 100644 (file)
--- a/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers_p2p.c
@@ -2693,7 +2693,7 @@ DBusMessage * wpas_dbus_handler_p2p_delete_service(
        if (!wpa_dbus_dict_open_read(&iter, &iter_dict, NULL))
                goto error;
 
-       if (wpa_dbus_dict_has_dict_entry(&iter_dict)) {
+       while (wpa_dbus_dict_has_dict_entry(&iter_dict)) {
                if (!wpa_dbus_dict_get_entry(&iter_dict, &entry))
                        goto error;
 
@@ -2705,27 +2705,27 @@ DBusMessage * wpas_dbus_handler_p2p_delete_service(
                                bonjour = 1;
                        else
                                goto error_clear;
+               } else if (os_strcmp(entry.key, "version") == 0 &&
+                          entry.type == DBUS_TYPE_INT32) {
+                       version = entry.uint32_value;
+               } else if (os_strcmp(entry.key, "service") == 0 &&
+                          entry.type == DBUS_TYPE_STRING) {
+                       os_free(service);
+                       service = os_strdup(entry.str_value);
+               } else if (os_strcmp(entry.key, "query") == 0) {
+                       if (entry.type != DBUS_TYPE_ARRAY ||
+                           entry.array_type != DBUS_TYPE_BYTE)
+                               goto error_clear;
+                       wpabuf_free(query);
+                       query = wpabuf_alloc_copy(entry.bytearray_value,
+                                                 entry.array_len);
+               } else {
+                       goto error_clear;
                }
 
                wpa_dbus_dict_entry_clear(&entry);
        }
        if (upnp == 1) {
-               while (wpa_dbus_dict_has_dict_entry(&iter_dict)) {
-                       if (!wpa_dbus_dict_get_entry(&iter_dict, &entry))
-                               goto error;
-                       if (os_strcmp(entry.key, "version") == 0 &&
-                           entry.type == DBUS_TYPE_INT32)
-                               version = entry.uint32_value;
-                       else if (os_strcmp(entry.key, "service") == 0 &&
-                                entry.type == DBUS_TYPE_STRING) {
-                               os_free(service);
-                               service = os_strdup(entry.str_value);
-                       } else
-                               goto error_clear;
-
-                       wpa_dbus_dict_entry_clear(&entry);
-               }
-
                if (version <= 0 || service == NULL)
                        goto error;
 
@@ -2733,24 +2733,6 @@ DBusMessage * wpas_dbus_handler_p2p_delete_service(
                if (ret != 0)
                        goto error;
        } else if (bonjour == 1) {
-               while (wpa_dbus_dict_has_dict_entry(&iter_dict)) {
-                       if (!wpa_dbus_dict_get_entry(&iter_dict, &entry))
-                               goto error;
-
-                       if (os_strcmp(entry.key, "query") == 0) {
-                               if (entry.type != DBUS_TYPE_ARRAY ||
-                                   entry.array_type != DBUS_TYPE_BYTE)
-                                       goto error_clear;
-                               wpabuf_free(query);
-                               query = wpabuf_alloc_copy(
-                                       entry.bytearray_value,
-                                       entry.array_len);
-                       } else
-                               goto error_clear;
-
-                       wpa_dbus_dict_entry_clear(&entry);
-               }
-
                if (query == NULL)
                        goto error;