From: Simon McVittie <smcv@collabora.com>
Date: Wed, 11 Mar 2020 13:12:22 +0000 (+0000)
Subject: sysdeps-unix: Don't leak struct addrinfo on OOM during connect()
X-Git-Tag: dbus-1.13.14~10^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=682e61919692d7b7a5a15ef995641b2d70ed82b2;p=thirdparty%2Fdbus.git

sysdeps-unix: Don't leak struct addrinfo on OOM during connect()

If we ran out of memory while handling connect() errors, we didn't
free the linked list of struct addrinfo. Move their cleanup to the
"out" phase of the function so that we always do it.

While I'm there, change the iterator variable tmp to be const, to make
it more obvious that we aren't meant to free it.

This is similar to commit 00badeba (!143) in the corresponding Windows
code path, but with some refactoring.

Signed-off-by: Simon McVittie <smcv@collabora.com>
---

diff --git a/dbus/dbus-sysdeps-unix.c b/dbus/dbus-sysdeps-unix.c
index c91c05ef4..4607f5370 100644
--- a/dbus/dbus-sysdeps-unix.c
+++ b/dbus/dbus-sysdeps-unix.c
@@ -1411,7 +1411,8 @@ _dbus_connect_tcp_socket_with_nonce (const char     *host,
   DBusSocket fd = DBUS_SOCKET_INIT;
   int res;
   struct addrinfo hints;
-  struct addrinfo *ai, *tmp;
+  struct addrinfo *ai = NULL;
+  const struct addrinfo *tmp;
   DBusError *connect_error;
 
   _DBUS_ASSERT_ERROR_IS_CLEAR(error);
@@ -1450,7 +1451,6 @@ _dbus_connect_tcp_socket_with_nonce (const char     *host,
     {
       if (!_dbus_open_socket (&fd.fd, tmp->ai_family, SOCK_STREAM, 0, error))
         {
-          freeaddrinfo(ai);
           _DBUS_ASSERT_ERROR_IS_SET(error);
           _dbus_socket_invalidate (&fd);
           goto out;
@@ -1491,7 +1491,6 @@ _dbus_connect_tcp_socket_with_nonce (const char     *host,
 
       break;
     }
-  freeaddrinfo(ai);
 
   if (!_dbus_socket_is_valid (fd))
     {
@@ -1523,6 +1522,9 @@ _dbus_connect_tcp_socket_with_nonce (const char     *host,
     }
 
 out:
+  if (ai != NULL)
+    freeaddrinfo (ai);
+
   while ((connect_error = _dbus_list_pop_first (&connect_errors)))
     {
       dbus_error_free (connect_error);