Fix possible resource leak if a attribute is repeated, overriding the
original value.
Error: RESOURCE_LEAK (CWE-772): [#def28] [important]
bluez-5.76/obexd/plugins/messages-dummy.c:362:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline".
bluez-5.76/obexd/plugins/messages-dummy.c:362:4: var_assign: Assigning: "entry->handle" = storage returned from "g_strdup_inline(values[i])".
bluez-5.76/obexd/plugins/messages-dummy.c:362:4: overwrite_var: Overwriting "entry->handle" in "entry->handle = g_strdup_inline(values[i])" leaks the storage that "entry->handle" points to.
360| for (i = 0 ; names[i]; ++i) {
361| if (g_strcmp0(names[i], "handle") == 0) {
362|-> entry->handle = g_strdup(values[i]);
363| mld->size++;
364| continue;
Error: RESOURCE_LEAK (CWE-772): [#def29] [important]
bluez-5.76/obexd/plugins/messages-dummy.c:367:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline".
bluez-5.76/obexd/plugins/messages-dummy.c:367:4: var_assign: Assigning: "entry->attachment_size" = storage returned from "g_strdup_inline(values[i])".
bluez-5.76/obexd/plugins/messages-dummy.c:367:4: overwrite_var: Overwriting "entry->attachment_size" in "entry->attachment_size = g_strdup_inline(values[i])" leaks the storage that "entry->attachment_size" points to.
365| }
366| if (g_strcmp0(names[i], "attachment_size") == 0) {
367|-> entry->attachment_size = g_strdup(values[i]);
368| continue;
369| }
Error: RESOURCE_LEAK (CWE-772): [#def30] [important]
bluez-5.76/obexd/plugins/messages-dummy.c:371:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline".
bluez-5.76/obexd/plugins/messages-dummy.c:371:4: var_assign: Assigning: "entry->datetime" = storage returned from "g_strdup_inline(values[i])".
bluez-5.76/obexd/plugins/messages-dummy.c:371:4: overwrite_var: Overwriting "entry->datetime" in "entry->datetime = g_strdup_inline(values[i])" leaks the storage that "entry->datetime" points to.
369| }
370| if (g_strcmp0(names[i], "datetime") == 0) {
371|-> entry->datetime = g_strdup(values[i]);
372| continue;
373| }
Error: RESOURCE_LEAK (CWE-772): [#def31] [important]
bluez-5.76/obexd/plugins/messages-dummy.c:375:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline".
bluez-5.76/obexd/plugins/messages-dummy.c:375:4: var_assign: Assigning: "entry->subject" = storage returned from "g_strdup_inline(values[i])".
bluez-5.76/obexd/plugins/messages-dummy.c:375:4: overwrite_var: Overwriting "entry->subject" in "entry->subject = g_strdup_inline(values[i])" leaks the storage that "entry->subject" points to.
373| }
374| if (g_strcmp0(names[i], "subject") == 0) {
375|-> entry->subject = g_strdup(values[i]);
376| continue;
377| }
Error: RESOURCE_LEAK (CWE-772): [#def32] [important]
bluez-5.76/obexd/plugins/messages-dummy.c:379:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline".
bluez-5.76/obexd/plugins/messages-dummy.c:379:4: var_assign: Assigning: "entry->recipient_addressing" = storage returned from "g_strdup_inline(values[i])".
bluez-5.76/obexd/plugins/messages-dummy.c:379:4: overwrite_var: Overwriting "entry->recipient_addressing" in "entry->recipient_addressing = g_strdup_inline(values[i])" leaks the storage that "entry->recipient_addressing" points to.
377| }
378| if (g_strcmp0(names[i], "recipient_addressing") == 0) {
379|-> entry->recipient_addressing = g_strdup(values[i]);
380| continue;
381| }
Error: RESOURCE_LEAK (CWE-772): [#def33] [important]
bluez-5.76/obexd/plugins/messages-dummy.c:383:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline".
bluez-5.76/obexd/plugins/messages-dummy.c:383:4: var_assign: Assigning: "entry->sender_addressing" = storage returned from "g_strdup_inline(values[i])".
bluez-5.76/obexd/plugins/messages-dummy.c:383:4: overwrite_var: Overwriting "entry->sender_addressing" in "entry->sender_addressing = g_strdup_inline(values[i])" leaks the storage that "entry->sender_addressing" points to.
381| }
382| if (g_strcmp0(names[i], "sender_addressing") == 0) {
383|-> entry->sender_addressing = g_strdup(values[i]);
384| continue;
385| }
Error: RESOURCE_LEAK (CWE-772): [#def34] [important]
bluez-5.76/obexd/plugins/messages-dummy.c:387:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline".
bluez-5.76/obexd/plugins/messages-dummy.c:387:4: var_assign: Assigning: "entry->type" = storage returned from "g_strdup_inline(values[i])".
bluez-5.76/obexd/plugins/messages-dummy.c:387:4: overwrite_var: Overwriting "entry->type" in "entry->type = g_strdup_inline(values[i])" leaks the storage that "entry->type" points to.
385| }
386| if (g_strcmp0(names[i], "type") == 0) {
387|-> entry->type = g_strdup(values[i]);
388| continue;
389| }
Error: RESOURCE_LEAK (CWE-772): [#def35] [important]
bluez-5.76/obexd/plugins/messages-dummy.c:391:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline".
bluez-5.76/obexd/plugins/messages-dummy.c:391:4: var_assign: Assigning: "entry->reception_status" = storage returned from "g_strdup_inline(values[i])".
bluez-5.76/obexd/plugins/messages-dummy.c:391:4: overwrite_var: Overwriting "entry->reception_status" in "entry->reception_status = g_strdup_inline(values[i])" leaks the storage that "entry->reception_status" points to.
389| }
390| if (g_strcmp0(names[i], "reception_status") == 0)
391|-> entry->reception_status = g_strdup(values[i]);
392| }
393|
---
obexd/plugins/messages-dummy.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/obexd/plugins/messages-dummy.c b/obexd/plugins/messages-dummy.c
index e37b52df6266..92378dab4b20 100644
--- a/obexd/plugins/messages-dummy.c
+++ b/obexd/plugins/messages-dummy.c
@@ -359,36 +359,45 @@ static void msg_element(GMarkupParseContext *ctxt, const char *element,
for (i = 0 ; names[i]; ++i) {
if (g_strcmp0(names[i], "handle") == 0) {
+ g_free(entry->handle);
entry->handle = g_strdup(values[i]);
mld->size++;
continue;
}
if (g_strcmp0(names[i], "attachment_size") == 0) {
+ g_free(entry->attachment_size);
entry->attachment_size = g_strdup(values[i]);
continue;
}
if (g_strcmp0(names[i], "datetime") == 0) {
+ g_free(entry->datetime);
entry->datetime = g_strdup(values[i]);
continue;
}
if (g_strcmp0(names[i], "subject") == 0) {
+ g_free(entry->subject);
entry->subject = g_strdup(values[i]);
continue;
}
if (g_strcmp0(names[i], "recipient_addressing") == 0) {
+ g_free(entry->recipient_addressing);
entry->recipient_addressing = g_strdup(values[i]);
continue;
}
if (g_strcmp0(names[i], "sender_addressing") == 0) {
+ g_free(entry->sender_addressing);
entry->sender_addressing = g_strdup(values[i]);
continue;
}
if (g_strcmp0(names[i], "type") == 0) {
+ g_free(entry->type);
entry->type = g_strdup(values[i]);
continue;
}
- if (g_strcmp0(names[i], "reception_status") == 0)
+ if (g_strcmp0(names[i], "reception_status") == 0) {
+ g_free(entry->reception_status);
entry->reception_status = g_strdup(values[i]);
+ }
}
if (mld->size > mld->offset)
--
2.45.2
