Changeset 05816dd

Timestamp:

2015-02-22T22:44:40Z (10 years ago)

Author:

dequis <dx@…>

Branches:

master

Children:

570f183

Parents:

91f06e5

git-author:

dequis <dx@…> (22-02-15 22:04:08)

git-committer:

dequis <dx@…> (22-02-15 22:44:40)

Message:

coverity: Fix some (harmless?) use-after-free with g_slist_remove()

These were passing a pointer to a variable right after it was g_free()'d

They are most likely harmless as g_slist_remove() probably just needs
the pointer location, but fixing it anyway.

Files:

• ipc.c (modified) (2 diffs)
• lib/oauth.c (modified) (1 diff)
• protocols/bee_user.c (modified) (2 diffs)
• protocols/msn/msn.c (modified) (2 diffs)
• protocols/msn/ns.c (modified) (1 diff)
• protocols/msn/sb.c (modified) (1 diff)
• protocols/yahoo/yahoo.c (modified) (1 diff)

ipc.c

@@ -776 +776 @@
         }
 
+        child_list = g_slist_remove(child_list, c);
+
         g_free(c->host);
         g_free(c->nick);
@@ -781 +783 @@
         g_free(c->password);
         g_free(c);
-
-        child_list = g_slist_remove(child_list, c);
 
         /* Also, if any child has a reference to this one, remove it. */

lib/oauth.c

@@ -107 +107 @@
                 if (strncmp((char *) l->data, key, key_len) == 0 &&
                     ((char *) l->data)[key_len] == '=') {
+                        *params = g_slist_remove(*params, l->data);
                         g_free(l->data);
-                        *params = g_slist_remove(*params, l->data);
                 }
         }

protocols/bee_user.c

@@ -68 +68 @@
         }
 
+        bee->users = g_slist_remove(bee->users, bu);
+
         g_free(bu->handle);
         g_free(bu->fullname);
@@ -74 +76 @@
         g_free(bu->status_msg);
         g_free(bu);
-
-        bee->users = g_slist_remove(bee->users, bu);
 
         return 1;

protocols/msn/msn.c

@@ -112 +112 @@
                 while (md->groups) {
                         struct msn_group *mg = md->groups->data;
+                        md->groups = g_slist_remove(md->groups, mg);
                         g_free(mg->id);
                         g_free(mg->name);
                         g_free(mg);
-                        md->groups = g_slist_remove(md->groups, mg);
                 }
 
@@ -127 +127 @@
                 while (md->grpq) {
                         struct msn_groupadd *ga = md->grpq->data;
+                        md->grpq = g_slist_remove(md->grpq, ga);
                         g_free(ga->group);
                         g_free(ga->who);
                         g_free(ga);
-                        md->grpq = g_slist_remove(md->grpq, ga);
                 }
 

protocols/msn/ns.c

@@ -944 +944 @@
                 struct msn_message *m = (*msgq)->data;
 
+                *msgq = g_slist_remove(*msgq, m);
                 g_free(m->who);
                 g_free(m->text);
                 g_free(m);
-
-                *msgq = g_slist_remove(*msgq, m);
-        }
-}
+        }
+}

protocols/msn/sb.c

@@ -519 +519 @@
                                         }
                                 }
+                                sb->msgq = g_slist_remove(sb->msgq, m);
                                 g_free(m->text);
                                 g_free(m->who);
                                 g_free(m);
-
-                                sb->msgq = g_slist_remove(sb->msgq, m);
                         }
 

protocols/yahoo/yahoo.c

@@ -733 +733 @@
                 inp = l->data;
                 if (inp->h == tag) {
+                        byahoo_inputs = g_slist_remove(byahoo_inputs, inp);
                         g_free(inp->d);
                         g_free(inp);
-                        byahoo_inputs = g_slist_remove(byahoo_inputs, inp);
                         break;
                 }