Fix append_and_grow_string for memory leaks and potential data corruption if memory allocation fails

1 files changed, 12 insertions, 6 deletions

diff --git a/hcid/dbus-sdp.c b/hcid/dbus-sdp.c
index 3e68c7e0..5a79a7b4 100644
--- a/hcid/dbus-sdp.c
+++ b/hcid/dbus-sdp.c
@@ -222,26 +222,32 @@ static sdp_session_t *get_sdp_session(bdaddr_t *src, bdaddr_t *dst)
 
 static void append_and_grow_string(void *data, const char *str)
 {
-	sdp_buf_t *buff = (sdp_buf_t *) data;
+	sdp_buf_t *buff = data;
 	int len;
 
 	len = strlen(str);
 
 	if (!buff->data) {
-		buff->buf_size = DEFAULT_XML_BUF_SIZE;
-		buff->data = realloc(buff->data, buff->buf_size);
+		buff->data = malloc(DEFAULT_XML_BUF_SIZE);
 		if (!buff->data)
 			return;
+		buff->buf_size = DEFAULT_XML_BUF_SIZE;
 	}
 
 	/* Grow string */
 	while (buff->buf_size < (buff->data_size + len + 1)) {
+		void *tmp;
+		uint32_t new_size;
+
 		/* Grow buffer by a factor of 2 */
-		buff->buf_size = (buff->buf_size << 1);
+		new_size = (buff->buf_size << 1);
 
-		buff->data = realloc(buff->data, buff->buf_size);
-		if (!buff->data)
+		tmp = realloc(buff->data, new_size);
+		if (!tmp)
 			return;
+
+		buff->data = tmp;
+		buff->buf_size = new_size;
 	}
 
 	/* Include the NULL character */