@@ -359,36 +359,45 @@ static void msg_element(GMarkupParseContext *ctxt, const char *element,
for (i = 0 ; names[i]; ++i) {
if (g_strcmp0(names[i], "handle") == 0) {
+ g_free(entry->handle);
entry->handle = g_strdup(values[i]);
mld->size++;
continue;
}
if (g_strcmp0(names[i], "attachment_size") == 0) {
+ g_free(entry->attachment_size);
entry->attachment_size = g_strdup(values[i]);
continue;
}
if (g_strcmp0(names[i], "datetime") == 0) {
+ g_free(entry->datetime);
entry->datetime = g_strdup(values[i]);
continue;
}
if (g_strcmp0(names[i], "subject") == 0) {
+ g_free(entry->subject);
entry->subject = g_strdup(values[i]);
continue;
}
if (g_strcmp0(names[i], "recipient_addressing") == 0) {
+ g_free(entry->recipient_addressing);
entry->recipient_addressing = g_strdup(values[i]);
continue;
}
if (g_strcmp0(names[i], "sender_addressing") == 0) {
+ g_free(entry->sender_addressing);
entry->sender_addressing = g_strdup(values[i]);
continue;
}
if (g_strcmp0(names[i], "type") == 0) {
+ g_free(entry->type);
entry->type = g_strdup(values[i]);
continue;
}
- if (g_strcmp0(names[i], "reception_status") == 0)
+ if (g_strcmp0(names[i], "reception_status") == 0) {
+ g_free(entry->reception_status);
entry->reception_status = g_strdup(values[i]);
+ }
}
if (mld->size > mld->offset)
Fix possible resource leak if a attribute is repeated, overriding the original value. Error: RESOURCE_LEAK (CWE-772): [#def28] [important] bluez-5.76/obexd/plugins/messages-dummy.c:362:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline". bluez-5.76/obexd/plugins/messages-dummy.c:362:4: var_assign: Assigning: "entry->handle" = storage returned from "g_strdup_inline(values[i])". bluez-5.76/obexd/plugins/messages-dummy.c:362:4: overwrite_var: Overwriting "entry->handle" in "entry->handle = g_strdup_inline(values[i])" leaks the storage that "entry->handle" points to. 360| for (i = 0 ; names[i]; ++i) { 361| if (g_strcmp0(names[i], "handle") == 0) { 362|-> entry->handle = g_strdup(values[i]); 363| mld->size++; 364| continue; Error: RESOURCE_LEAK (CWE-772): [#def29] [important] bluez-5.76/obexd/plugins/messages-dummy.c:367:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline". bluez-5.76/obexd/plugins/messages-dummy.c:367:4: var_assign: Assigning: "entry->attachment_size" = storage returned from "g_strdup_inline(values[i])". bluez-5.76/obexd/plugins/messages-dummy.c:367:4: overwrite_var: Overwriting "entry->attachment_size" in "entry->attachment_size = g_strdup_inline(values[i])" leaks the storage that "entry->attachment_size" points to. 365| } 366| if (g_strcmp0(names[i], "attachment_size") == 0) { 367|-> entry->attachment_size = g_strdup(values[i]); 368| continue; 369| } Error: RESOURCE_LEAK (CWE-772): [#def30] [important] bluez-5.76/obexd/plugins/messages-dummy.c:371:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline". bluez-5.76/obexd/plugins/messages-dummy.c:371:4: var_assign: Assigning: "entry->datetime" = storage returned from "g_strdup_inline(values[i])". bluez-5.76/obexd/plugins/messages-dummy.c:371:4: overwrite_var: Overwriting "entry->datetime" in "entry->datetime = g_strdup_inline(values[i])" leaks the storage that "entry->datetime" points to. 369| } 370| if (g_strcmp0(names[i], "datetime") == 0) { 371|-> entry->datetime = g_strdup(values[i]); 372| continue; 373| } Error: RESOURCE_LEAK (CWE-772): [#def31] [important] bluez-5.76/obexd/plugins/messages-dummy.c:375:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline". bluez-5.76/obexd/plugins/messages-dummy.c:375:4: var_assign: Assigning: "entry->subject" = storage returned from "g_strdup_inline(values[i])". bluez-5.76/obexd/plugins/messages-dummy.c:375:4: overwrite_var: Overwriting "entry->subject" in "entry->subject = g_strdup_inline(values[i])" leaks the storage that "entry->subject" points to. 373| } 374| if (g_strcmp0(names[i], "subject") == 0) { 375|-> entry->subject = g_strdup(values[i]); 376| continue; 377| } Error: RESOURCE_LEAK (CWE-772): [#def32] [important] bluez-5.76/obexd/plugins/messages-dummy.c:379:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline". bluez-5.76/obexd/plugins/messages-dummy.c:379:4: var_assign: Assigning: "entry->recipient_addressing" = storage returned from "g_strdup_inline(values[i])". bluez-5.76/obexd/plugins/messages-dummy.c:379:4: overwrite_var: Overwriting "entry->recipient_addressing" in "entry->recipient_addressing = g_strdup_inline(values[i])" leaks the storage that "entry->recipient_addressing" points to. 377| } 378| if (g_strcmp0(names[i], "recipient_addressing") == 0) { 379|-> entry->recipient_addressing = g_strdup(values[i]); 380| continue; 381| } Error: RESOURCE_LEAK (CWE-772): [#def33] [important] bluez-5.76/obexd/plugins/messages-dummy.c:383:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline". bluez-5.76/obexd/plugins/messages-dummy.c:383:4: var_assign: Assigning: "entry->sender_addressing" = storage returned from "g_strdup_inline(values[i])". bluez-5.76/obexd/plugins/messages-dummy.c:383:4: overwrite_var: Overwriting "entry->sender_addressing" in "entry->sender_addressing = g_strdup_inline(values[i])" leaks the storage that "entry->sender_addressing" points to. 381| } 382| if (g_strcmp0(names[i], "sender_addressing") == 0) { 383|-> entry->sender_addressing = g_strdup(values[i]); 384| continue; 385| } Error: RESOURCE_LEAK (CWE-772): [#def34] [important] bluez-5.76/obexd/plugins/messages-dummy.c:387:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline". bluez-5.76/obexd/plugins/messages-dummy.c:387:4: var_assign: Assigning: "entry->type" = storage returned from "g_strdup_inline(values[i])". bluez-5.76/obexd/plugins/messages-dummy.c:387:4: overwrite_var: Overwriting "entry->type" in "entry->type = g_strdup_inline(values[i])" leaks the storage that "entry->type" points to. 385| } 386| if (g_strcmp0(names[i], "type") == 0) { 387|-> entry->type = g_strdup(values[i]); 388| continue; 389| } Error: RESOURCE_LEAK (CWE-772): [#def35] [important] bluez-5.76/obexd/plugins/messages-dummy.c:391:4: alloc_fn: Storage is returned from allocation function "g_strdup_inline". bluez-5.76/obexd/plugins/messages-dummy.c:391:4: var_assign: Assigning: "entry->reception_status" = storage returned from "g_strdup_inline(values[i])". bluez-5.76/obexd/plugins/messages-dummy.c:391:4: overwrite_var: Overwriting "entry->reception_status" in "entry->reception_status = g_strdup_inline(values[i])" leaks the storage that "entry->reception_status" points to. 389| } 390| if (g_strcmp0(names[i], "reception_status") == 0) 391|-> entry->reception_status = g_strdup(values[i]); 392| } 393| --- obexd/plugins/messages-dummy.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)