Fix several invalid read/write memory and definitely lost memory

Change-Id: Ife9d0f2808e068e5b52bb0e8eabbec147a826beb
Signed-off-by: Yu jiung <jiung.yu@samsung.com>

diff --git a/src/wifi-direct-dbus.c b/src/wifi-direct-dbus.c
index c62979a..d9a7c52 100644 (file)
--- a/src/wifi-direct-dbus.c
+++ b/src/wifi-direct-dbus.c
@@ -893,6 +893,7 @@ void wfd_manager_dbus_deinit(void)
        g_bus_unown_name(g_owner_id);
 }
 
+#if !defined(BUILD_GTESTS)
 gboolean wfd_manager_dbus_emit_signal(const gchar *interface_name,
                                      const gchar *signal_name,
                                      GVariant *parameters)
@@ -963,6 +964,36 @@ void wfd_manager_dbus_reply_params(GDBusMethodInvocation *invocation, GVariant *
 
        return;
 }
+#else /* BUILD_GTESTS */
+gboolean wfd_manager_dbus_emit_signal(const gchar *interface_name,
+                                     const gchar *signal_name,
+                                     GVariant *parameters)
+{
+       if (parameters)
+               g_variant_unref(parameters);
+
+       return;
+}
+
+void wfd_manager_dbus_return_err(int ret, GDBusMethodInvocation *invocation)
+{
+       return;
+}
+
+void wfd_manager_dbus_reply_error_none(GDBusMethodInvocation *invocation)
+{
+       return;
+}
+
+void wfd_manager_dbus_reply_params(GDBusMethodInvocation *invocation, GVariant *parameters)
+{
+       if (parameters)
+               g_variant_unref(parameters);
+
+       return;
+}
+#endif /* BUILD_GTESTS */
+
 //LCOV_EXCL_STOP
 GVariant* wfd_manager_dbus_pack_ay(const unsigned char *src, int size)
 {

diff --git a/src/wifi-direct-event.c b/src/wifi-direct-event.c
index 9769283..848cd5f 100755 (executable)
--- a/src/wifi-direct-event.c
+++ b/src/wifi-direct-event.c
@@ -1188,6 +1188,7 @@ void wfd_event_sta_disconnected(wfd_oem_event_s *event)
        unsigned char peer_addr[MACADDR_LEN] = {0, };
        char peer_mac_address[MACSTR_LEN+1] = {0, };
        char peer_dev_name[DEV_NAME_LEN+1] = {0, };
+       int member_cnt;
 
        group = (wfd_group_s*) manager->group;
        if (!group) {
@@ -1251,9 +1252,9 @@ void wfd_event_sta_disconnected(wfd_oem_event_s *event)
        if (manager->state >= WIFI_DIRECT_STATE_CONNECTED ||
                                (manager->state == WIFI_DIRECT_STATE_DISCOVERING &&
                                 manager->local->dev_role == WFD_DEV_ROLE_GO)) {
-               wfd_group_remove_member(group, peer_addr);
+               member_cnt = wfd_group_remove_member(group, peer_addr);
                g_snprintf(peer_mac_address, MACSTR_LEN, MACSTR, MAC2STR(peer_addr));
-               if (group->member_count) {
+               if (member_cnt) {
                        wfd_manager_dbus_emit_signal(WFD_MANAGER_MANAGE_INTERFACE,
                                                     "DisconnectionInd",
                                                     g_variant_new("(iiss)", WIFI_DIRECT_ERROR_NONE,
@@ -1308,7 +1309,9 @@ void wfd_event_sta_disconnected(wfd_oem_event_s *event)
        }
 
        /* If there is no member, GO should be destroyed */
-       if (!group->member_count && wfd_util_is_remove_group_allowed()) {
+
+       group = (wfd_group_s*)manager->group;
+       if (group && !group->member_count && wfd_util_is_remove_group_allowed()) {
                wfd_oem_destroy_group(manager->oem_ops, group->ifname);
                wfd_destroy_group(manager);
                wfd_peer_clear_all(manager);

diff --git a/src/wifi-direct-group.c b/src/wifi-direct-group.c
index fb65fb7..b109a21 100644 (file)
--- a/src/wifi-direct-group.c
+++ b/src/wifi-direct-group.c
@@ -373,6 +373,7 @@ int wfd_group_remove_member(wfd_group_s *group, unsigned char *addr)
        __WDS_LOG_FUNC_ENTER__;//LCOV_EXCL_LINE
        wfd_device_s *member = NULL;
        wfd_manager_s *manager = wfd_get_manager();
+       int member_cnt;
 
        if (!group || !addr) {
                WDS_LOGE("Invalid parameter");//LCOV_EXCL_LINE
@@ -397,6 +398,7 @@ int wfd_group_remove_member(wfd_group_s *group, unsigned char *addr)
        group->members = g_list_remove(group->members, member);
        g_free(member);
        group->member_count--;
+       member_cnt = group->member_count;
 
        if (group->role == WFD_DEV_ROLE_GO) {
                if (!group->member_count && wfd_util_is_remove_group_allowed()) {
@@ -411,5 +413,5 @@ int wfd_group_remove_member(wfd_group_s *group, unsigned char *addr)
        }
 
        __WDS_LOG_FUNC_EXIT__;//LCOV_EXCL_LINE
-       return 0;
+       return member_cnt;
 }

diff --git a/src/wifi-direct-manager.c b/src/wifi-direct-manager.c
index 9f0155f..4bd7971 100644 (file)
--- a/src/wifi-direct-manager.c
+++ b/src/wifi-direct-manager.c
@@ -1008,6 +1008,7 @@ int wfd_manager_cancel_connection(wfd_manager_s *manager, unsigned char *peer_ad
 {
        __WDS_LOG_FUNC_ENTER__;//LCOV_EXCL_LINE
        wfd_group_s *group = NULL;
+       int member_cnt = 0;
        int res = 0;
 
        if (!manager || !peer_addr) {
@@ -1028,13 +1029,13 @@ int wfd_manager_cancel_connection(wfd_manager_s *manager, unsigned char *peer_ad
 
        group = (wfd_group_s*) manager->group;
        if (group)
-               wfd_group_remove_member(group, peer_addr);
+               member_cnt = wfd_group_remove_member(group, peer_addr);
        else
                manager->local->dev_role = WFD_DEV_ROLE_NONE;
 
        if (manager->local->dev_role == WFD_DEV_ROLE_GO) {
                wfd_state_set(manager, WIFI_DIRECT_STATE_GROUP_OWNER);
-               if (group->member_count)
+               if (member_cnt)
                        wfd_util_set_wifi_direct_state(WIFI_DIRECT_STATE_GROUP_OWNER);
        } else {
                wfd_state_set(manager, WIFI_DIRECT_STATE_ACTIVATED);

diff --git a/src/wifi-direct-method.c b/src/wifi-direct-method.c
index 80f4886..72deac8 100755 (executable)
--- a/src/wifi-direct-method.c
+++ b/src/wifi-direct-method.c
@@ -308,6 +308,7 @@ void get_discovered_peer_handler(GVariant *parameters, void *dest)
        g_variant_builder_unref(builder_peers);
        wfd_manager_dbus_reply_params((GDBusMethodInvocation *)dest, return_parameters);
 
+       g_free(peers);
        __WDS_LOG_FUNC_EXIT__;//LCOV_EXCL_LINE
        return;
 }

diff --git a/src/wifi-direct-peer.c b/src/wifi-direct-peer.c
index 9cb8d89..75ca415 100644 (file)
--- a/src/wifi-direct-peer.c
+++ b/src/wifi-direct-peer.c
@@ -195,8 +195,12 @@ int wfd_peer_clear_all(void *data)
        __WDS_LOG_FUNC_ENTER__;//LCOV_EXCL_LINE
        wfd_manager_s *manager = (wfd_manager_s*) data;
        wfd_device_s *peer = NULL;
+       wfd_session_s *session = NULL;
        GList *temp = NULL;
 
+       if (!manager)
+               return -1;
+
        if (manager->peer_count == 0) {
                WDS_LOGD("Peer not exist");//LCOV_EXCL_LINE
                return -1;
@@ -221,6 +225,10 @@ int wfd_peer_clear_all(void *data)
                return 1;
        }
 
+       session = manager->session;
+       if (session)
+               session->peer = NULL;
+
        __WDS_LOG_FUNC_EXIT__;//LCOV_EXCL_LINE
        return 0;
 }

diff --git a/src/wifi-direct-session.c b/src/wifi-direct-session.c
index f5211f7..6b294b7 100644 (file)
--- a/src/wifi-direct-session.c
+++ b/src/wifi-direct-session.c
@@ -632,7 +632,7 @@ int wfd_session_invite(wfd_session_s *session)
        group = (wfd_group_s*) manager->group;
 
        memset(&param, 0x00, sizeof(wfd_oem_invite_param_s));
-       param.ifname = strdup(group->ifname);
+       param.ifname = g_strdup(group->ifname);
        memcpy(param.go_dev_addr, group->go_dev_addr, MACADDR_LEN);
 
        WDS_LOGD("Invite: Peer[" MACSTR "], GO Addr[" MACSTR "]",
@@ -642,11 +642,13 @@ int wfd_session_invite(wfd_session_s *session)
        if (res < 0) {
                WDS_LOGE("Failed to invite with peer [" MACSECSTR "]", MAC2SECSTR(peer->dev_addr));
                wfd_destroy_session(manager);
+               g_free(param.ifname);
                __WDS_LOG_FUNC_EXIT__;//LCOV_EXCL_LINE
                return -1;
        }
 
        wfd_session_timer(session, 1);
+       g_free(param.ifname);
 
        __WDS_LOG_FUNC_EXIT__;//LCOV_EXCL_LINE
        return 0;

diff --git a/src/wifi-direct-util.c b/src/wifi-direct-util.c
index a493d7f..4754ab7 100644 (file)
--- a/src/wifi-direct-util.c
+++ b/src/wifi-direct-util.c
@@ -136,9 +136,10 @@ static GKeyFile *__load_key_file()
 }
 
 
-static void __load_wfd_config(GKeyFile *key_file, struct key_value *conf_key_val)
+static void __load_wfd_config(GKeyFile **key_file, struct key_value *conf_key_val)
 {
        __WDS_LOG_FUNC_ENTER__;//LCOV_EXCL_LINE
+       GKeyFile *result;
        GError *error = NULL;
        int i = 0;
        if (!conf_key_val) {
@@ -146,8 +147,8 @@ static void __load_wfd_config(GKeyFile *key_file, struct key_value *conf_key_val
                return;
        }
 
-       key_file = __load_key_file();
-       if (!key_file) {
+       result = __load_key_file();
+       if (!result) {
                __WDS_LOG_FUNC_EXIT__;//LCOV_EXCL_LINE
                return;
        }
@@ -163,7 +164,7 @@ static void __load_wfd_config(GKeyFile *key_file, struct key_value *conf_key_val
                        (!g_strcmp0(conf_key_val[i].key, "operating_channel")) ||
                        (!g_strcmp0(conf_key_val[i].key, "group_operating_freq"))) {
 
-                       conf_key_val[i].int_value = g_key_file_get_integer(key_file,
+                       conf_key_val[i].int_value = g_key_file_get_integer(result,
                                        WFD_CONF_GROUP_NAME, conf_key_val[i].key, &error);
                        if (error) {
                                WDS_LOGE("Unable to load %s : %s", conf_key_val[i].key, error->message);
@@ -180,7 +181,7 @@ static void __load_wfd_config(GKeyFile *key_file, struct key_value *conf_key_val
                if (!g_strcmp0(conf_key_val[i].key, "persistent_reconnect") ||
                        !g_strcmp0(conf_key_val[i].key, "no_group_iface")) {
 
-                       conf_key_val[i].bool_value = g_key_file_get_boolean(key_file,
+                       conf_key_val[i].bool_value = g_key_file_get_boolean(result,
                                        WFD_CONF_GROUP_NAME, conf_key_val[i].key, &error);
                        if (error) {
                                WDS_LOGE("Unable to load %s : %s", conf_key_val[i].key, error->message);
@@ -194,7 +195,7 @@ static void __load_wfd_config(GKeyFile *key_file, struct key_value *conf_key_val
                        continue;
                }
 
-               conf_key_val[i].value = g_key_file_get_string(key_file,
+               conf_key_val[i].value = g_key_file_get_string(result,
                                WFD_CONF_GROUP_NAME, conf_key_val[i].key, &error);
                if (!conf_key_val[i].value) {
                        WDS_LOGE("Unable to load %s : %s", conf_key_val[i].key, error->message);
@@ -210,6 +211,7 @@ static void __load_wfd_config(GKeyFile *key_file, struct key_value *conf_key_val
                }
        }
 
+       *key_file = result;
        __WDS_LOG_FUNC_EXIT__;//LCOV_EXCL_LINE
        return;
 }
@@ -227,8 +229,9 @@ static void __unload_wfd_config(GKeyFile *key_file, struct key_value *conf_key_v
                g_free(conf_key_val[i].value);
        }
 
-       g_key_file_free(key_file);
-       __WDS_LOG_FUNC_EXIT__;//LCOV_EXCL_LINE
+       if (key_file)
+               g_key_file_unref(key_file);
+       __WDS_LOG_FUNC_EXIT__;
        return;
 }
 
@@ -442,7 +445,7 @@ void wfd_util_load_wfd_conf(wfd_manager_s * manager)
                return;
        }
 
-       __load_wfd_config(key_file, wfd_conf);
+       __load_wfd_config(&key_file, wfd_conf);
 
        if (wfd_conf[WFD_CONF_ON_DEMAND].value &&
                        g_strcmp0(wfd_conf[WFD_CONF_ON_DEMAND].value, "yes") == 0)