From: Simon McVittie <smcv@collabora.com>
Date: Tue, 4 Jul 2017 13:13:15 +0000 (+0100)
Subject: dbus_message_iter_append_basic: Don't leak signature if appending fd fails
X-Git-Tag: dbus-1.12.0~47^2~19
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=0907c2b9fdc5c7194bb6fef16e6f1d67d830c95d;p=platform%2Fupstream%2Fdbus.git

dbus_message_iter_append_basic: Don't leak signature if appending fd fails

Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
(cherry picked from commit 8384e795516066960bb9fcfbfe138f569420edb9)
---

diff --git a/dbus/dbus-message.c b/dbus/dbus-message.c
index 0df6667..7186e6d 100644
--- a/dbus/dbus-message.c
+++ b/dbus/dbus-message.c
@@ -2785,20 +2785,22 @@ dbus_message_iter_append_basic (DBusMessageIter *iter,
       int *fds;
       dbus_uint32_t u;
 
+      ret = FALSE;
+
       /* First step, include the fd in the fd list of this message */
       if (!(fds = expand_fd_array(real->message, 1)))
-        return FALSE;
+        goto out;
 
       *fds = _dbus_dup(*(int*) value, NULL);
       if (*fds < 0)
-        return FALSE;
+        goto out;
 
       u = real->message->n_unix_fds;
 
       /* Second step, write the index to the fd */
       if (!(ret = _dbus_type_writer_write_basic (&real->u.writer, DBUS_TYPE_UNIX_FD, &u))) {
         _dbus_close(*fds, NULL);
-        return FALSE;
+        goto out;
       }
 
       real->message->n_unix_fds += 1;
@@ -2817,6 +2819,9 @@ dbus_message_iter_append_basic (DBusMessageIter *iter,
          freed. */
 #else
       ret = FALSE;
+      /* This is redundant (we could just fall through), but it avoids
+       * -Wunused-label in builds that don't HAVE_UNIX_FD_PASSING */
+      goto out;
 #endif
     }
   else
@@ -2824,6 +2829,7 @@ dbus_message_iter_append_basic (DBusMessageIter *iter,
       ret = _dbus_type_writer_write_basic (&real->u.writer, type, value);
     }
 
+out:
   if (!_dbus_message_iter_close_signature (real))
     ret = FALSE;