Bug 69327

Summary: NULL dereference on an error code path
Product: dbus Reporter: Sviatoslav Chagaev <sviatoslav.chagaev>
Component: coreAssignee: Havoc Pennington <hp>
Status: RESOLVED FIXED QA Contact:
Severity: major    
Priority: medium Keywords: patch
Version: unspecified   
Hardware: All   
OS: All   
Whiteboard:
i915 platform: i915 features:
Attachments: Patch for 1.6
Patch for 1.7

Description Sviatoslav Chagaev 2013-09-13 17:01:29 UTC
_dbus_noncefile_delete() doesn't check that it was passed a NULL argument and will dereference it.
Comment 1 Sviatoslav Chagaev 2013-09-13 17:02:11 UTC
Created attachment 85779 [details] [review]
Patch for 1.6
Comment 2 Sviatoslav Chagaev 2013-09-13 17:02:41 UTC
Created attachment 85780 [details] [review]
Patch for 1.7
Comment 3 Simon McVittie 2013-09-16 11:48:56 UTC
Looks correct, although I hate this style of cleanup. I'll propose a patch to make the cleanup more obvious...
Comment 4 Simon McVittie 2013-09-16 12:06:04 UTC
(In reply to comment #3)
> Looks correct, although I hate this style of cleanup. I'll propose a patch
> to make the cleanup more obvious...

... actually, I won't, because the DBusString API is remarkably annoying. Never mind :-(

Fixed in git for 1.6.16 and 1.7.6, thanks.
Comment 5 Sviatoslav Chagaev 2013-09-16 15:27:57 UTC
(In reply to comment #4)
> (In reply to comment #3)
> > Looks correct, although I hate this style of cleanup. I'll propose a patch
> > to make the cleanup more obvious...
> 
> ... actually, I won't, because the DBusString API is remarkably annoying.
> Never mind :-(
> 
> Fixed in git for 1.6.16 and 1.7.6, thanks.

Thanks!

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.