session: parse_bearers() should check for invalid types

diff --git a/src/session.c b/src/session.c
index 85ce909b850532a38931d8fff299e630de75b3bf..caa2901259f7c0ed1816f18499028c7ddcd9717f 100644 (file)
--- a/src/session.c
+++ b/src/session.c
@@ -390,15 +390,22 @@ static int parse_bearers(DBusMessageIter *iter, GSList **list)
 {
        struct connman_session_bearer *bearer;
        DBusMessageIter array;
-       int err;
+       int type, err;
 
        dbus_message_iter_recurse(iter, &array);
 
        *list = NULL;
 
-       while (dbus_message_iter_get_arg_type(&array) == DBUS_TYPE_STRING) {
+       while ((type = dbus_message_iter_get_arg_type(&array)) !=
+                       DBUS_TYPE_INVALID) {
                char *bearer_name = NULL;
 
+               if (type != DBUS_TYPE_STRING) {
+                       connman_session_free_bearers(*list);
+                       *list = NULL;
+                       return -EINVAL;
+               }
+
                dbus_message_iter_get_basic(&array, &bearer_name);
 
                bearer = g_try_new0(struct connman_session_bearer, 1);