From: Simon McVittie <smcv@collabora.com>
Date: Mon, 6 Nov 2017 19:09:51 +0000 (+0000)
Subject: do_check_nonce: Don't free uninitialized memory on OOM
X-Git-Tag: dbus-1.12.2~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=208af9a447f3960db08083e1127d7389bdb711f2;p=thirdparty%2Fdbus.git

do_check_nonce: Don't free uninitialized memory on OOM

If _dbus_string_init() fails, it doesn't guarantee that the string
is initialized to anything in particular. Worse, if
_dbus_string_init (&buffer) fails, p would never have been initialized
at all, due to the use of the short-circuiting || operator.

Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=103597
(cherry picked from commit 0ea0e4b0fddd1109835b8b9f7a8319d59c8d9303)
---

diff --git a/dbus/dbus-nonce.c b/dbus/dbus-nonce.c
index bc3286cc9..49f873693 100644
--- a/dbus/dbus-nonce.c
+++ b/dbus/dbus-nonce.c
@@ -43,6 +43,20 @@ do_check_nonce (DBusSocket fd, const DBusString *nonce, DBusError *error)
 
   nleft = 16;
 
+  /* This is a trick to make it safe to call _dbus_string_free on these
+   * strings during error unwinding, even if allocating memory for them
+   * fails. A constant DBusString is considered to be valid to "free",
+   * even though there is nothing to free (of course the free operation
+   * is trivial, because it does not own its own buffer); but
+   * unlike a mutable DBusString, initializing a constant DBusString
+   * cannot fail.
+   *
+   * We must successfully re-initialize the strings to be mutable before
+   * writing to them, of course.
+   */
+  _dbus_string_init_const (&buffer, "");
+  _dbus_string_init_const (&p, "");
+
   if (   !_dbus_string_init (&buffer)
       || !_dbus_string_init (&p) ) {
         dbus_set_error (error, DBUS_ERROR_NO_MEMORY, NULL);