Fix critical issues of SVACE

Fixes for critical issues which are reported from SVACE

Change-Id: Ib5ccc552af3e494b3fc35dfdf5ce89b80345af29

diff --git a/obexd/plugins/messages-tizen.c b/obexd/plugins/messages-tizen.c
index 8f684fc..04018d7 100644 (file)
--- a/obexd/plugins/messages-tizen.c
+++ b/obexd/plugins/messages-tizen.c
@@ -357,15 +357,21 @@ static void message_get_folder_list(DBusMessage *reply, void *user_data)
        DBusMessageIter entry;
        DBusError derr;
        const char *name = NULL;
-       struct message_folder *parent = {0,}, *child = {0,};
+       struct message_folder *parent = folder_tree, *child = NULL;
        GSList *l;
 
-       DBG("+\n");
+       DBG("+");
 
-       for (l = folder_tree->subfolders; l != NULL; l = parent->subfolders)
+       for (l = folder_tree->subfolders; l != NULL; l = parent->subfolders) {
                parent = l->data;
+               if (parent == NULL) {
+                       error("folder list is corrupted");
+                       dbus_message_unref(reply);
+                       return;
+               }
+       }
 
-       DBG("Last child folder = %s \n", parent->name);
+       DBG("Last child folder = %s", parent->name);
        dbus_error_init(&derr);
 
        if (dbus_set_error_from_message(&derr, reply)) {
@@ -380,7 +386,7 @@ static void message_get_folder_list(DBusMessage *reply, void *user_data)
                        dbus_message_iter_recurse(&iter_struct, &entry);
 
                        dbus_message_iter_get_basic(&entry, &name);
-                       DBG("Folder name = %s \n", name);
+                       DBG("Folder name = %s", name);
                        child = create_folder(name);
                        parent->subfolders = g_slist_append(parent->subfolders,
                                                        child);
@@ -388,7 +394,7 @@ static void message_get_folder_list(DBusMessage *reply, void *user_data)
                }
        }
        dbus_message_unref(reply);
-       DBG("-\n");
+       DBG("-");
 }
 
 static void message_get_msg_list(DBusPendingCall *call, void *user_data)
@@ -425,7 +431,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
        struct session *session = user_data;
        struct messages_message *data = g_new0(struct messages_message, 1);
 
-       DBG("+\n");
+       DBG("+");
        DBG("parameter_mask = %x; type = %d; period_begin = %s;"
                "period_end = %s; read_status = %d; recipient = %s;"
                "originator = %s; priority = %d",
@@ -476,14 +482,14 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                        continue;
                }
 
-               DBG("Msg handle = %s \n", msg_handle);
+               DBG("Msg handle = %s", msg_handle);
                data->handle = g_strdup(msg_handle);
 
                dbus_message_iter_next(&entry);
                dbus_message_iter_get_basic(&entry, &subject);
 
                if (mask & PMASK_SUBJECT) {
-                       DBG("subject = %s\n", subject);
+                       DBG("subject = %s", subject);
                        data->subject = g_strndup(subject,
                                                BT_MAP_LIST_ITEM_MAX_LEN);
                        data->mask |= PMASK_SUBJECT;
@@ -493,7 +499,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&entry, &datetime);
 
                if ((mask & PMASK_DATETIME) && (NULL != datetime)) {
-                       DBG("datetime = %s\n", datetime);
+                       DBG("datetime = %s", datetime);
                        char *begin = g_strdup(session->filter->period_begin);
                        char *end = g_strdup(session->filter->period_end);
                        char *time = g_strdup(datetime);
@@ -520,7 +526,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
 
                if ((mask & PMASK_SENDER_NAME) &&
                                (NULL != session->filter->originator)) {
-                       DBG("sender_name = %s \n", sender_name);
+                       DBG("sender_name = %s", sender_name);
 
                        if (g_strstr_len(sender_name, -1,
                                        session->filter->originator)) {
@@ -539,7 +545,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
 
                if ((mask & PMASK_SENDER_ADDRESSING) &&
                                                (NULL != sender_addressing)) {
-                       DBG("sender_addressing = %s \n", sender_addressing);
+                       DBG("sender_addressing = %s", sender_addressing);
 
                        data->sender_addressing = g_strndup(sender_addressing,
                                                BT_MAP_LIST_ITEM_MAX_LEN);
@@ -551,7 +557,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
 
                if ((mask & PMASK_RECIPIENT_NAME) &&
                                (NULL != session->filter->recipient)) {
-                       DBG("recipient_name = %s \n", recipient_name);
+                       DBG("recipient_name = %s", recipient_name);
 
                        if (g_strstr_len(recipient_name, -1,
                                        session->filter->recipient)) {
@@ -571,7 +577,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
 
                if ((mask & PMASK_RECIPIENT_ADDRESSING) &&
                                (NULL != recipient_addressing)) {
-                       DBG("recipient_addressing=%s\n", recipient_addressing);
+                       DBG("recipient_addressing=%s", recipient_addressing);
 
                        data->recipient_addressing =
                                        g_strndup(recipient_addressing,
@@ -583,7 +589,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&entry, &type);
 
                if ((mask & PMASK_TYPE) && (NULL != type)) {
-                       DBG("type = %s \n", type);
+                       DBG("type = %s", type);
 
                        type_val = get_type_val(type);
                        if (!(session->filter->type & type_val)) {
@@ -596,7 +602,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&entry, &size);
 
                if ((mask & PMASK_SIZE) && (NULL != size)) {
-                       DBG("size = %s \n", size);
+                       DBG("size = %s", size);
 
                        data->size = g_strdup(size);
                        data->mask |= PMASK_SIZE;
@@ -606,7 +612,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&entry, &reception_status);
 
                if (mask & PMASK_RECEPTION_STATUS) {
-                       DBG("reception_status = %s \n", reception_status);
+                       DBG("reception_status = %s", reception_status);
 
                        data->reception_status = g_strdup(reception_status);
                        data->mask |= PMASK_RECEPTION_STATUS;
@@ -616,7 +622,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&entry, &text);
 
                if (mask & PMASK_TEXT) {
-                       DBG("text = %d \n", text);
+                       DBG("text = %d", text);
                        data->text = text;
                        data->mask |= PMASK_TEXT;
                }
@@ -625,7 +631,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&entry, &attachment_size);
 
                if (mask & PMASK_ATTACHMENT_SIZE) {
-                       DBG("attachment_size = %s\n", attachment_size);
+                       DBG("attachment_size = %s", attachment_size);
 
                        data->attachment_size = g_strdup(attachment_size);
                        data->mask |= PMASK_ATTACHMENT_SIZE;
@@ -635,7 +641,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&entry, &priority);
 
                if (mask & PMASK_PRIORITY) {
-                       DBG("priority = %d \n", priority);
+                       DBG("priority = %d", priority);
 
                        priority_val = get_priority_val(priority);
                        if ((session->filter->priority == 0) ||
@@ -653,7 +659,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&entry, &read);
 
                if (mask & PMASK_READ) {
-                       DBG("read = %d \n", read);
+                       DBG("read = %d", read);
 
                        read_val = get_read_status_val(read);
 
@@ -672,7 +678,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&entry, &sent);
 
                if (mask & PMASK_SENT) {
-                       DBG("sent = %d \n", sent);
+                       DBG("sent = %d", sent);
                        data->sent = sent;
                        data->mask |= PMASK_SENT;
                }
@@ -681,7 +687,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&entry, &protect);
 
                if (mask & PMASK_PROTECTED) {
-                       DBG("protect = %d \n", protect);
+                       DBG("protect = %d", protect);
                        data->protect = protect;
                        data->mask |= PMASK_PROTECTED;
                }
@@ -692,7 +698,7 @@ static void message_get_msg_list(DBusPendingCall *call, void *user_data)
                if ((mask & PMASK_REPLYTO_ADDRESSING) &&
                                                (0x04 == get_type_val(type))) {
 
-                       DBG("replyto_addressing = %s \n", replyto_addressing);
+                       DBG("replyto_addressing = %s", replyto_addressing);
                        if (replyto_addressing)
                                data->replyto_addressing =
                                                g_strdup(replyto_addressing);
@@ -717,7 +723,7 @@ done:
        g_free(session->name);
        session_filter_free(session->filter);
        dbus_message_unref(reply);
-       DBG("-\n");
+       DBG("-");
 }
 
 static void message_get_msg(DBusPendingCall *call, void *user_data)
@@ -729,7 +735,7 @@ static void message_get_msg(DBusPendingCall *call, void *user_data)
        char *msg_body;
        gboolean fraction_deliver;
 
-       DBG("+\n");
+       DBG("+");
 
        dbus_error_init(&derr);
        if (dbus_set_error_from_message(&derr, reply)) {
@@ -740,7 +746,7 @@ static void message_get_msg(DBusPendingCall *call, void *user_data)
                dbus_message_iter_get_basic(&iter, &fraction_deliver);
                dbus_message_iter_next(&iter);
                dbus_message_iter_get_basic(&iter, &msg_body);
-               DBG("msg_body %s\n", msg_body);
+               DBG("msg_body %s", msg_body);
 
                session->get_msg_cb(session, -EAGAIN, fraction_deliver,
                                        msg_body, session->user_data);
@@ -748,7 +754,7 @@ static void message_get_msg(DBusPendingCall *call, void *user_data)
                                        NULL, session->user_data);
        }
        dbus_message_unref(reply);
-       DBG("-\n");
+       DBG("-");
 }
 
 int messages_connect(void **s)
@@ -756,7 +762,7 @@ int messages_connect(void **s)
        DBusMessage *message;
        DBusMessage *reply;
        DBusError err;
-       DBG("+\n");
+       DBG("+");
 
        struct session *session = g_new0(struct session, 1);
 
@@ -773,6 +779,9 @@ int messages_connect(void **s)
                                                QUERY_GET_FOLDER_TREE);
        if (!message) {
                error("Can't allocate new message");
+               g_free(session->cwd);
+               g_free(session);
+               *s = NULL;
                return -1;
        }
 
@@ -788,13 +797,17 @@ int messages_connect(void **s)
                }
 
                dbus_message_unref(message);
+
+               g_free(session->cwd);
+               g_free(session);
+               *s = NULL;
                return -1;
        }
 
        message_get_folder_list(reply, session);
 
        dbus_message_unref(message);
-       DBG("-\n");
+       DBG("-");
        return 0;
 }
 
@@ -802,7 +815,7 @@ void messages_disconnect(void *s)
 {
        DBusMessage *message;
        struct session *session = s;
-       DBG("+\n");
+       DBG("+");
 
        destroy_folder_tree(folder_tree);
        folder_tree = NULL;
@@ -824,12 +837,12 @@ void messages_disconnect(void *s)
 
        dbus_message_unref(message);
 
-       DBG("-\n");
+       DBG("-");
 }
 
 static gboolean notification_registration(gpointer user_data)
 {
-       DBG("+\n");
+       DBG("+");
        DBusMessage *message = NULL;
        gboolean reg;
        struct mns_reg_data *data = (struct mns_reg_data *)user_data;
@@ -843,7 +856,7 @@ static gboolean notification_registration(gpointer user_data)
                goto done;
        }
 
-       DBG("data->notification_status = %d\n", data->notification_status);
+       DBG("data->notification_status = %d", data->notification_status);
 
        if (data->notification_status == 1)
                reg = TRUE;
@@ -863,7 +876,7 @@ done:
        g_free(data->remote_addr);
        g_free(data);
 
-       DBG("-\n");
+       DBG("-");
        return FALSE;
 }
 
@@ -871,15 +884,15 @@ int messages_set_notification_registration(void *session,
                                char *address, uint8_t status,
                                void *user_data)
 {
-       DBG("+\n");
+       DBG("+");
        struct mns_reg_data *data = g_new0(struct mns_reg_data, 1);
        data->notification_status = status;
        data->remote_addr = g_strdup(address);
 
-       DBG("status = %d\n", status);
+       DBG("status = %d", status);
 
        g_idle_add(notification_registration, data);
-       DBG("-\n");
+       DBG("-");
        return 1;
 }
 
@@ -997,7 +1010,7 @@ int messages_get_folder_listing(void *s, const char *name,
                                        messages_folder_listing_cb callback,
                                        void *user_data)
 {
-       DBG("+\n");
+       DBG("+");
        struct session *session = s;
        session->name = g_strdup(name);
        session->max = max;
@@ -1008,7 +1021,7 @@ int messages_get_folder_listing(void *s, const char *name,
        g_idle_add_full(G_PRIORITY_DEFAULT_IDLE, async_get_folder_listing,
                                                session, NULL);
 
-       DBG("-\n");
+       DBG("-");
        return 0;
 }
 
@@ -1092,30 +1105,30 @@ int messages_get_messages_listing(void *session, const char *name,
                        DBUS_TYPE_VARIANT_AS_STRING
                        DBUS_DICT_ENTRY_END_CHAR_AS_STRING, &dict);
 
-       if (filter->parameter_mask)
+       if (s->filter->parameter_mask)
                dict_append_entry(&dict, "ParameterMask", DBUS_TYPE_UINT32,
-                                       &filter->parameter_mask);
-       if (filter->type)
+                                       &s->filter->parameter_mask);
+       if (s->filter->type)
                dict_append_entry(&dict, "FilterMessageType", DBUS_TYPE_BYTE,
-                                       &filter->type);
-       if (filter->period_begin)
+                                       &s->filter->type);
+       if (s->filter->period_begin)
                dict_append_entry(&dict, "FilterPeriodBegin", DBUS_TYPE_STRING,
-                                       &filter->period_begin);
-       if (filter->period_end)
+                                       &s->filter->period_begin);
+       if (s->filter->period_end)
                dict_append_entry(&dict, "FilterPeriodEnd", DBUS_TYPE_STRING,
-                                       &filter->period_end);
-       if (filter->read_status)
+                                       &s->filter->period_end);
+       if (s->filter->read_status)
                dict_append_entry(&dict, "FilterReadStatus", DBUS_TYPE_BYTE,
-                                       &filter->read_status);
-       if (filter->recipient)
+                                       &s->filter->read_status);
+       if (s->filter->recipient)
                dict_append_entry(&dict, "FilterRecipient", DBUS_TYPE_STRING,
-                                       &filter->recipient);
-       if (filter->originator)
+                                       &s->filter->recipient);
+       if (s->filter->originator)
                dict_append_entry(&dict, "FilterOriginator", DBUS_TYPE_STRING,
-                                       &filter->originator);
-       if (filter->priority)
+                                       &s->filter->originator);
+       if (s->filter->priority)
                dict_append_entry(&dict, "FilterPriority", DBUS_TYPE_BYTE,
-                                       &filter->priority);
+                                       &s->filter->priority);
 
        dbus_message_iter_close_container(&iter, &dict);
 
@@ -1129,7 +1142,7 @@ int messages_get_messages_listing(void *session, const char *name,
        }
        dbus_pending_call_set_notify(call, message_get_msg_list, s, NULL);
        dbus_message_unref(message);
-       DBG("-\n");
+       DBG("-");
        return 1;
 }
 
@@ -1150,9 +1163,9 @@ int messages_push_message(void *session, const char *folder,
        gchar *folder_path = NULL;
        guint64 handle = 0;
 
-       DBG("+\n");
+       DBG("+");
 
-       DBG("session->cwd %s +\n", s->cwd);
+       DBG("session->cwd %s +", s->cwd);
 
        if (g_ascii_strncasecmp(s->cwd, "/telecom/msg",
                        strlen("/telecom/msg")) != 0) {
@@ -1178,17 +1191,17 @@ int messages_push_message(void *session, const char *folder,
 
        if (!(retry & 0x1)) {
                retry_send = FALSE;
-               DBG("Retry send %d\n", retry_send);
+               DBG("Retry send %d", retry_send);
        }
 
        if (charset & 0x1) {
                native = TRUE;
-               DBG("native send %d\n", native);
+               DBG("native send %d", native);
        }
 
-       DBG("save_copy  %d\n", save_copy);
-       DBG("retry_send %d\n", retry_send);
-       DBG("native %d\n", native);
+       DBG("save_copy  %d", save_copy);
+       DBG("retry_send %d", retry_send);
+       DBG("native %d", native);
 
        message = dbus_message_new_method_call(BT_MAP_SERVICE_NAME,
                                                BT_MAP_SERVICE_OBJECT_PATH,
@@ -1226,7 +1239,7 @@ int messages_push_message(void *session, const char *folder,
        if (!dbus_message_get_args(reply, &err, DBUS_TYPE_UINT64,
                                                &handle, DBUS_TYPE_INVALID)) {
                if (dbus_error_is_set(&err)) {
-                       error("err %s\n", err.message);
+                       error("err %s", err.message);
                        dbus_error_free(&err);
                }
                g_free(folder_path);
@@ -1235,14 +1248,14 @@ int messages_push_message(void *session, const char *folder,
                return -1;
        }
 
-       DBG("uint64 handle %"G_GUINT64_FORMAT"\n", handle);
+       DBG("uint64 handle %"G_GUINT64_FORMAT"", handle);
        s->push_msg_cb(s, 0, handle, s->user_data);
 
        g_free(folder_path);
        dbus_message_unref(message);
        dbus_message_unref(reply);
 
-       DBG("-\n");
+       DBG("-");
        return 1;
 }
 
@@ -1250,7 +1263,7 @@ int messages_push_message_data(void *session, const char *bmsg, void *user_data)
 {
        DBusMessage *message;
 
-       DBG("+\n");
+       DBG("+");
 
        message = dbus_message_new_method_call(BT_MAP_SERVICE_NAME,
                                                BT_MAP_SERVICE_OBJECT_PATH,
@@ -1271,7 +1284,7 @@ int messages_push_message_data(void *session, const char *bmsg, void *user_data)
        }
 
        dbus_message_unref(message);
-       DBG("-\n");
+       DBG("-");
        return 1;
 }
 
@@ -1290,11 +1303,11 @@ int messages_get_message(void *session,
        gboolean transcode = FALSE;
        gboolean first_request = TRUE;
 
-       DBG("+\n");
+       DBG("+");
 
        if (NULL != handle) {
                message_name =  g_strdup(handle);
-               DBG("Message handle = %s\n", handle);
+               DBG("Message handle = %s", handle);
        } else {
                return -1;
        }
@@ -1336,7 +1349,7 @@ int messages_get_message(void *session,
        dbus_pending_call_set_notify(call, message_get_msg, s, NULL);
        dbus_message_unref(message);
        g_free(message_name);
-       DBG("-\n");
+       DBG("-");
        return 1;
 }
 
@@ -1348,7 +1361,7 @@ static void message_update_msg(DBusPendingCall *call, void *user_data)
        DBusError derr;
        struct session *session = user_data;
        int err;
-       DBG("+\n");
+       DBG("+");
 
        dbus_error_init(&derr);
        if (dbus_set_error_from_message(&derr, reply)) {
@@ -1359,13 +1372,13 @@ static void message_update_msg(DBusPendingCall *call, void *user_data)
                if (dbus_message_iter_get_arg_type(&iter) ==
                                                        DBUS_TYPE_INT32) {
                        dbus_message_iter_get_basic(&iter, &err);
-                       DBG("Error : %d\n", err);
+                       DBG("Error : %d", err);
                        session->msg_update_cb(session, err,
                                                session->user_data);
                }
        }
        dbus_message_unref(reply);
-       DBG("-\n");
+       DBG("-");
 }
 #endif
 
@@ -1384,7 +1397,7 @@ int messages_update_inbox(void *session,
        DBusMessage *message;
        struct session *s = session;
 
-       DBG("+\n");
+       DBG("+");
 
        s->msg_update_cb = callback;
        s->user_data = user_data;
@@ -1406,7 +1419,7 @@ int messages_update_inbox(void *session,
        }
        dbus_pending_call_set_notify(call, message_update_msg, s, NULL);
        dbus_message_unref(message);
-       DBG("-\n");
+       DBG("-");
        return 1;
 #endif
 }
@@ -1419,7 +1432,7 @@ static void message_status_msg(DBusPendingCall *call, void *user_data)
        struct session *session = user_data;
        int err;
 
-       DBG("+\n");
+       DBG("+");
 
        dbus_error_init(&derr);
        if (dbus_set_error_from_message(&derr, reply)) {
@@ -1430,13 +1443,13 @@ static void message_status_msg(DBusPendingCall *call, void *user_data)
                if (dbus_message_iter_get_arg_type(&iter) ==
                                                        DBUS_TYPE_INT32) {
                        dbus_message_iter_get_basic(&iter, &err);
-                       DBG("Error : %d\n", err);
+                       DBG("Error : %d", err);
                        session->msg_status_cb(session, err,
                                                session->user_data);
                }
        }
        dbus_message_unref(reply);
-       DBG("-\n");
+       DBG("-");
 }
 
 int messages_set_read(void *session, const char *handle, uint8_t value,
@@ -1448,12 +1461,12 @@ int messages_set_read(void *session, const char *handle, uint8_t value,
        char *message_name;
        gboolean read;
 
-       DBG("+\n");
+       DBG("+");
 
        if (NULL == handle)
                return -1;
 
-       DBG("Message handle = %s\n", handle);
+       DBG("Message handle = %s", handle);
        message_name = g_strdup(handle);
 
        s->msg_status_cb = callback;
@@ -1486,7 +1499,7 @@ int messages_set_read(void *session, const char *handle, uint8_t value,
        dbus_pending_call_set_notify(call, message_status_msg, s, NULL);
        dbus_message_unref(message);
        g_free(message_name);
-       DBG("-\n");
+       DBG("-");
        return 1;
 }
 
@@ -1501,12 +1514,12 @@ int messages_set_delete(void *session, const char *handle,
        char *message_name;
        gboolean del;
 
-       DBG("+\n");
+       DBG("+");
 
        if (NULL == handle)
                return -1;
 
-       DBG("Message handle = %s\n", handle);
+       DBG("Message handle = %s", handle);
        message_name = g_strdup(handle);
 
        s->msg_status_cb = callback;
@@ -1539,7 +1552,7 @@ int messages_set_delete(void *session, const char *handle,
        dbus_pending_call_set_notify(call, message_status_msg, s, NULL);
        dbus_message_unref(message);
        g_free(message_name);
-       DBG("-\n");
+       DBG("-");
        return 1;
 }
 

diff --git a/obexd/plugins/pbap.c b/obexd/plugins/pbap.c
index 0949b6a..efd76ac 100644 (file)
--- a/obexd/plugins/pbap.c
+++ b/obexd/plugins/pbap.c
@@ -587,6 +587,8 @@ static void *pbap_connect(struct obex_session *os, int *err)
 
 #ifdef TIZEN_FEATURE_BLUEZ_MODIFY
 failed:
+       g_free(pbap->backend_data);
+       g_free(pbap->folder);
        g_free(pbap);
 
        return NULL;