Commit 4aa79f1f authored by Ander Conselvan de Oliveira's avatar Ander Conselvan de Oliveira Committed by Ulrich Sibiller

Fix leaks in _XimEncodingNegotiation error paths.

name_ptr and detail_ptr weren't free'd in some cases before returning False. Signed-off-by: 's avatarAnder Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com> Reviewed-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent 3720ed7b
...@@ -1713,11 +1713,8 @@ _XimEncodingNegotiation( ...@@ -1713,11 +1713,8 @@ _XimEncodingNegotiation(
if (!(_XimSetEncodingByName(im, &name_ptr, &name_len))) if (!(_XimSetEncodingByName(im, &name_ptr, &name_len)))
return False; return False;
if (!(_XimSetEncodingByDetail(im, &detail_ptr, &detail_len))) { if (!(_XimSetEncodingByDetail(im, &detail_ptr, &detail_len)))
if (name_ptr) goto free_name_ptr;
Xfree(name_ptr);
return False;
}
len = sizeof(CARD16) len = sizeof(CARD16)
+ sizeof(INT16) + sizeof(INT16)
...@@ -1727,13 +1724,9 @@ _XimEncodingNegotiation( ...@@ -1727,13 +1724,9 @@ _XimEncodingNegotiation(
+ sizeof(CARD16) + sizeof(CARD16)
+ detail_len; + detail_len;
if (!(buf = (CARD8 *)Xmalloc(XIM_HEADER_SIZE + len))) { if (!(buf = (CARD8 *)Xmalloc(XIM_HEADER_SIZE + len)))
if (name_ptr) goto free_detail_ptr;
Xfree(name_ptr);
if (detail_ptr)
Xfree(detail_ptr);
return False;
}
buf_s = (CARD16 *)&buf[XIM_HEADER_SIZE]; buf_s = (CARD16 *)&buf[XIM_HEADER_SIZE];
buf_s[0] = im->private.proto.imid; buf_s[0] = im->private.proto.imid;
...@@ -1750,7 +1743,7 @@ _XimEncodingNegotiation( ...@@ -1750,7 +1743,7 @@ _XimEncodingNegotiation(
_XimSetHeader((XPointer)buf, XIM_ENCODING_NEGOTIATION, 0, &len); _XimSetHeader((XPointer)buf, XIM_ENCODING_NEGOTIATION, 0, &len);
if (!(_XimWrite(im, len, (XPointer)buf))) { if (!(_XimWrite(im, len, (XPointer)buf))) {
Xfree(buf); Xfree(buf);
return False; goto free_detail_ptr;
} }
_XimFlush(im); _XimFlush(im);
Xfree(buf); Xfree(buf);
...@@ -1767,27 +1760,21 @@ _XimEncodingNegotiation( ...@@ -1767,27 +1760,21 @@ _XimEncodingNegotiation(
preply = (XPointer)Xmalloc(buf_size); preply = (XPointer)Xmalloc(buf_size);
ret_code = _XimRead(im, &len, preply, buf_size, ret_code = _XimRead(im, &len, preply, buf_size,
_XimEncodingNegoCheck, 0); _XimEncodingNegoCheck, 0);
if(ret_code != XIM_TRUE) { if(ret_code != XIM_TRUE)
Xfree(preply); goto free_preply;
return False;
}
} }
} else } else
return False; goto free_detail_ptr;
buf_s = (CARD16 *)((char *)preply + XIM_HEADER_SIZE); buf_s = (CARD16 *)((char *)preply + XIM_HEADER_SIZE);
if (*((CARD8 *)preply) == XIM_ERROR) { if (*((CARD8 *)preply) == XIM_ERROR) {
_XimProcError(im, 0, (XPointer)&buf_s[3]); _XimProcError(im, 0, (XPointer)&buf_s[3]);
if(reply != preply) goto free_preply;
Xfree(preply);
return False;
} }
if (!(_XimGetEncoding(im, &buf_s[1], name_ptr, name_len, if (!(_XimGetEncoding(im, &buf_s[1], name_ptr, name_len,
detail_ptr, detail_len))) { detail_ptr, detail_len)))
if(reply != preply) goto free_preply;
Xfree(preply);
return False;
}
if (name_ptr) if (name_ptr)
Xfree(name_ptr); Xfree(name_ptr);
if (detail_ptr) if (detail_ptr)
...@@ -1797,6 +1784,18 @@ _XimEncodingNegotiation( ...@@ -1797,6 +1784,18 @@ _XimEncodingNegotiation(
Xfree(preply); Xfree(preply);
return True; return True;
free_preply:
if (reply != preply)
Xfree(preply);
free_detail_ptr:
Xfree(detail_ptr);
free_name_ptr:
Xfree(name_ptr);
return False;
} }
#ifdef XIM_CONNECTABLE #ifdef XIM_CONNECTABLE
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment