From: Ralf Habacker <ralf.habacker@freenet.de>
Date: Tue, 28 Apr 2020 05:02:09 +0000 (+0200)
Subject: Fix bug not detecting out of memory condition in _dbus_poll_events ()
X-Git-Tag: dbus-1.13.16~10^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=96b829583125c39a88890989392948b33bdff8cc;p=thirdparty%2Fdbus.git

Fix bug not detecting out of memory condition in _dbus_poll_events ()

For cleaning purpose the event list members are initialized with
WSA_INVALID_EVENT. The cleanup code detects and handles the
case that the event list has been created from calloc ().
---

diff --git a/dbus/dbus-sysdeps-win.c b/dbus/dbus-sysdeps-win.c
index 4c813af3a..2a1a86ea3 100644
--- a/dbus/dbus-sysdeps-win.c
+++ b/dbus/dbus-sysdeps-win.c
@@ -1186,6 +1186,16 @@ _dbus_poll_events (DBusPollFD *fds,
   else
     pEvents = eventsOnStack;
 
+  if (pEvents == NULL)
+   {
+     _dbus_win_set_errno (ENOMEM);
+     ret = -1;
+     goto oom;
+   }
+
+  for (i = 0; i < n_fds; i++)
+    pEvents[i] = WSA_INVALID_EVENT;
+
   for (i = 0; i < n_fds; i++)
     {
       DBusPollFD *fdp = &fds[i];
@@ -1251,14 +1261,18 @@ _dbus_poll_events (DBusPollFD *fds,
       ret = -1;
     }
 
-  for(i = 0; i < n_fds; i++)
+oom:
+  if (pEvents != NULL)
     {
-      WSACloseEvent (pEvents[i]);
+      for (i = 0; i < n_fds; i++)
+        {
+          if (pEvents[i] != WSA_INVALID_EVENT)
+            WSACloseEvent (pEvents[i]);
+        }
+      if (n_fds > DBUS_STACK_WSAEVENTS)
+        free (pEvents);
     }
 
-  if (n_fds > DBUS_STACK_WSAEVENTS)
-    free (pEvents);
-
   return ret;
 }
 #else