diff options
author | Johan Hedberg <johan.hedberg@nokia.com> | 2007-05-03 11:49:43 +0000 |
---|---|---|
committer | Johan Hedberg <johan.hedberg@nokia.com> | 2007-05-03 11:49:43 +0000 |
commit | b509fbde6a79fadd1eaab46a7bb1d08ce1b28090 (patch) | |
tree | e1b3ea10c0ae52d627ef5bbb9edd41c6963ee998 /hcid | |
parent | 30957bc2890f3db99907178304046610e77c7efa (diff) |
Fix append_and_grow_string for memory leaks and potential data corruption if memory allocation fails
Diffstat (limited to 'hcid')
-rw-r--r-- | hcid/dbus-sdp.c | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/hcid/dbus-sdp.c b/hcid/dbus-sdp.c index 3e68c7e0..5a79a7b4 100644 --- a/hcid/dbus-sdp.c +++ b/hcid/dbus-sdp.c @@ -222,26 +222,32 @@ static sdp_session_t *get_sdp_session(bdaddr_t *src, bdaddr_t *dst) static void append_and_grow_string(void *data, const char *str) { - sdp_buf_t *buff = (sdp_buf_t *) data; + sdp_buf_t *buff = data; int len; len = strlen(str); if (!buff->data) { - buff->buf_size = DEFAULT_XML_BUF_SIZE; - buff->data = realloc(buff->data, buff->buf_size); + buff->data = malloc(DEFAULT_XML_BUF_SIZE); if (!buff->data) return; + buff->buf_size = DEFAULT_XML_BUF_SIZE; } /* Grow string */ while (buff->buf_size < (buff->data_size + len + 1)) { + void *tmp; + uint32_t new_size; + /* Grow buffer by a factor of 2 */ - buff->buf_size = (buff->buf_size << 1); + new_size = (buff->buf_size << 1); - buff->data = realloc(buff->data, buff->buf_size); - if (!buff->data) + tmp = realloc(buff->data, new_size); + if (!tmp) return; + + buff->data = tmp; + buff->buf_size = new_size; } /* Include the NULL character */ |