From 9835435400e945b294872a525aacf99a5ad5bcf5 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>

Date: Tue, 31 Dec 2013 11:23:58 -0500

Subject: [PATCH] sleep-config: fix double free

Before 34a3baa4d 'sleep-config: Dereference pointer before check for NULL'

oom conditions would not be detected properly. After that commit, a double

free was performed.

Rework the whole function to be easier to understand, and also replace

strv_split_nulstr with strv_new, since we know the strings anyway.

---

 src/shared/sleep-config.c | 38 ++++++++++++++++++++------------------

 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/src/shared/sleep-config.c b/src/shared/sleep-config.c

index b2a0787..70a0896 100644

--- a/src/shared/sleep-config.c

+++ b/src/shared/sleep-config.c

@@ -28,11 +28,14 @@

 #include "strv.h"

 #include "util.h"

-int parse_sleep_config(const char *verb, char ***modes, char ***states) {

+#define USE(x, y) do{ (x) = (y); (y) = NULL; } while(0)

+

+int parse_sleep_config(const char *verb, char ***_modes, char ***_states) {

         _cleanup_strv_free_ char

                 **suspend_mode = NULL, **suspend_state = NULL,

                 **hibernate_mode = NULL, **hibernate_state = NULL,

                 **hybrid_mode = NULL, **hybrid_state = NULL;

+        char **modes, **states;

         const ConfigTableItem items[] = {

                 { "Sleep",   "SuspendMode",      config_parse_strv,  0, &suspend_mode  },

@@ -59,47 +62,46 @@ int parse_sleep_config(const char *verb, char ***modes, char ***states) {

         if (streq(verb, "suspend")) {

                 /* empty by default */

-                *modes = suspend_mode;

+                USE(modes, suspend_mode);

                 if (suspend_state)

-                        *states = suspend_state;

+                        USE(states, suspend_state);

                 else

-                        *states = strv_split_nulstr("mem\0standby\0freeze\0");

+                        states = strv_new("mem", "standby", "freeze", NULL);

-                suspend_mode = suspend_state = NULL;

         } else if (streq(verb, "hibernate")) {

                 if (hibernate_mode)

-                        *modes = hibernate_mode;

+                        USE(modes, hibernate_mode);

                 else

-                        *modes = strv_split_nulstr("platform\0shutdown\0");

+                        modes = strv_new("platform", "shutdown", NULL);

                 if (hibernate_state)

-                        *states = hibernate_state;

+                        USE(states, hibernate_state);

                 else

-                        *states = strv_split_nulstr("disk\0");

+                        states = strv_new("disk", NULL);

-                hibernate_mode = hibernate_state = NULL;

         } else if (streq(verb, "hybrid-sleep")) {

                 if (hybrid_mode)

-                        *modes = hybrid_mode;

+                        USE(modes, hybrid_mode);

                 else

-                        *modes = strv_split_nulstr("suspend\0platform\0shutdown\0");

+                        modes = strv_new("suspend", "platform", "shutdown", NULL);

                 if (hybrid_state)

-                        *states = hybrid_state;

+                        USE(states, hybrid_state);

                 else

-                        *states = strv_split_nulstr("disk\0");

+                        states = strv_new("disk", NULL);

-                hybrid_mode = hybrid_state = NULL;

         } else

                 assert_not_reached("what verb");

-        if (!*modes || !*states) {

-                strv_free(*modes);

-                strv_free(*states);

+        if ((!modes && !streq(verb, "suspend")) || !states) {

+                strv_free(modes);

+                strv_free(states);

                 return log_oom();

         }

+        *_modes = modes;

+        *_states = states;

         return 0;

 }