dbus_message_iter_get_signature: Fix two memory leaks on OOM

Previously,  `retstr` would not be freed when `_dbus_string_append_len()`
or `_dbus_string_steal_data()` failed.

Fix those by:
 * jumping to `_dbus_string_free()` when `_dbus_string_append_len()` fails
 * ignoring the return value of `_dbus_string_free()`.

The latter works because in case of failure, `ret` will be set
to NULL by `_dbus_string_steal_data()`.

Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>

diff --git a/dbus/dbus-message.c b/dbus/dbus-message.c
index 9bc13cf90e5a1d2e5e4b6cbea4b8423e7b18c88c..a71442b523f0dddcec2406202252f5c653b479ee 100644 (file)
--- a/dbus/dbus-message.c
+++ b/dbus/dbus-message.c
@@ -2275,7 +2275,7 @@ dbus_message_iter_get_signature (DBusMessageIter *iter)
 {
   const DBusString *sig;
   DBusString retstr;
-  char *ret;
+  char *ret = NULL;
   int start, len;
   DBusMessageRealIter *real = (DBusMessageRealIter *)iter;
 
@@ -2289,9 +2289,13 @@ dbus_message_iter_get_signature (DBusMessageIter *iter)
   if (!_dbus_string_append_len (&retstr,
                                _dbus_string_get_const_data (sig) + start,
                                len))
-    return NULL;
-  if (!_dbus_string_steal_data (&retstr, &ret))
-    return NULL;
+    goto oom;
+
+  /* This is correct whether it succeeds or fails: on success it sets `ret`,
+   * and on failure it leaves `ret` set to NULL. */
+  _dbus_string_steal_data (&retstr, &ret);
+
+oom:
   _dbus_string_free (&retstr);
   return ret;
 }