sim-card
/
qemu
Archived
10
0
Fork 0

ui/vnc: Convert sasl.mechlist to g_malloc() & friends

Fixes protocol_client_auth_sasl_mechname() not to crash when malloc()
fails.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
This commit is contained in:
Markus Armbruster 2011-11-08 13:45:21 +01:00 committed by Stefan Hajnoczi
parent 542379f426
commit 302d9d6fd8
1 changed files with 5 additions and 14 deletions

View File

@ -35,7 +35,7 @@ void vnc_sasl_client_cleanup(VncState *vs)
vs->sasl.encodedLength = vs->sasl.encodedOffset = 0; vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
vs->sasl.encoded = NULL; vs->sasl.encoded = NULL;
g_free(vs->sasl.username); g_free(vs->sasl.username);
free(vs->sasl.mechlist); g_free(vs->sasl.mechlist);
vs->sasl.username = vs->sasl.mechlist = NULL; vs->sasl.username = vs->sasl.mechlist = NULL;
sasl_dispose(&vs->sasl.conn); sasl_dispose(&vs->sasl.conn);
vs->sasl.conn = NULL; vs->sasl.conn = NULL;
@ -430,11 +430,7 @@ static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size
static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len) static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len)
{ {
char *mechname = malloc(len + 1); char *mechname = g_malloc(len + 1);
if (!mechname) {
VNC_DEBUG("Out of memory reading mechname\n");
vnc_client_error(vs);
}
strncpy(mechname, (char*)data, len); strncpy(mechname, (char*)data, len);
mechname[len] = '\0'; mechname[len] = '\0';
VNC_DEBUG("Got client mechname '%s' check against '%s'\n", VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
@ -460,7 +456,7 @@ static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_
} }
} }
free(vs->sasl.mechlist); g_free(vs->sasl.mechlist);
vs->sasl.mechlist = mechname; vs->sasl.mechlist = mechname;
VNC_DEBUG("Validated mechname '%s'\n", mechname); VNC_DEBUG("Validated mechname '%s'\n", mechname);
@ -469,7 +465,7 @@ static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_
fail: fail:
vnc_client_error(vs); vnc_client_error(vs);
free(mechname); g_free(mechname);
return -1; return -1;
} }
@ -608,12 +604,7 @@ void start_auth_sasl(VncState *vs)
} }
VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist); VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);
if (!(vs->sasl.mechlist = strdup(mechlist))) { vs->sasl.mechlist = g_strdup(mechlist);
VNC_DEBUG("Out of memory");
sasl_dispose(&vs->sasl.conn);
vs->sasl.conn = NULL;
goto authabort;
}
mechlistlen = strlen(mechlist); mechlistlen = strlen(mechlist);
vnc_write_u32(vs, mechlistlen); vnc_write_u32(vs, mechlistlen);
vnc_write(vs, mechlist, mechlistlen); vnc_write(vs, mechlist, mechlistlen);