dbus: Avoid theoretical memory leaks with duplicated dict entries

If a dict would include duplicated items, the parsing code here would
have leaked memory by overwriting old os_strdup() result with the new
one. Fix this by explicitly freeing the previous entry. This addresses
CID 62852, CID 62851, CID 62850, CID 62849, CID 62847, CID 62846.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/dbus/dbus_new_handlers.c b/wpa_supplicant/dbus/dbus_new_handlers.c
index 27190c6..a89a87d 100644 (file)
--- a/wpa_supplicant/dbus/dbus_new_handlers.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers.c
@@ -562,24 +562,28 @@ DBusMessage * wpas_dbus_handler_create_interface(DBusMessage *message,
                        goto error;
                if (!os_strcmp(entry.key, "Driver") &&
                    (entry.type == DBUS_TYPE_STRING)) {
+                       os_free(driver);
                        driver = os_strdup(entry.str_value);
                        wpa_dbus_dict_entry_clear(&entry);
                        if (driver == NULL)
                                goto error;
                } else if (!os_strcmp(entry.key, "Ifname") &&
                           (entry.type == DBUS_TYPE_STRING)) {
+                       os_free(ifname);
                        ifname = os_strdup(entry.str_value);
                        wpa_dbus_dict_entry_clear(&entry);
                        if (ifname == NULL)
                                goto error;
                } else if (!os_strcmp(entry.key, "ConfigFile") &&
                           (entry.type == DBUS_TYPE_STRING)) {
+                       os_free(confname);
                        confname = os_strdup(entry.str_value);
                        wpa_dbus_dict_entry_clear(&entry);
                        if (confname == NULL)
                                goto error;
                } else if (!os_strcmp(entry.key, "BridgeIfname") &&
                           (entry.type == DBUS_TYPE_STRING)) {
+                       os_free(bridge_ifname);
                        bridge_ifname = os_strdup(entry.str_value);
                        wpa_dbus_dict_entry_clear(&entry);
                        if (bridge_ifname == NULL)

diff --git a/wpa_supplicant/dbus/dbus_old_handlers.c b/wpa_supplicant/dbus/dbus_old_handlers.c
index 7c4630e..c0cb1c2 100644 (file)
--- a/wpa_supplicant/dbus/dbus_old_handlers.c
+++ b/wpa_supplicant/dbus/dbus_old_handlers.c
@@ -113,24 +113,28 @@ DBusMessage * wpas_dbus_global_add_interface(DBusMessage *message,
                                goto error;
                        if (!strcmp(entry.key, "driver") &&
                            (entry.type == DBUS_TYPE_STRING)) {
+                               os_free(driver);
                                driver = os_strdup(entry.str_value);
                                wpa_dbus_dict_entry_clear(&entry);
                                if (driver == NULL)
                                        goto error;
                        } else if (!strcmp(entry.key, "driver-params") &&
                                   (entry.type == DBUS_TYPE_STRING)) {
+                               os_free(driver_param);
                                driver_param = os_strdup(entry.str_value);
                                wpa_dbus_dict_entry_clear(&entry);
                                if (driver_param == NULL)
                                        goto error;
                        } else if (!strcmp(entry.key, "config-file") &&
                                   (entry.type == DBUS_TYPE_STRING)) {
+                               os_free(confname);
                                confname = os_strdup(entry.str_value);
                                wpa_dbus_dict_entry_clear(&entry);
                                if (confname == NULL)
                                        goto error;
                        } else if (!strcmp(entry.key, "bridge-ifname") &&
                                   (entry.type == DBUS_TYPE_STRING)) {
+                               os_free(bridge_ifname);
                                bridge_ifname = os_strdup(entry.str_value);
                                wpa_dbus_dict_entry_clear(&entry);
                                if (bridge_ifname == NULL)
@@ -1200,16 +1204,19 @@ DBusMessage * wpas_dbus_iface_set_smartcard_modules(
                        goto error;
                if (!strcmp(entry.key, "opensc_engine_path") &&
                    (entry.type == DBUS_TYPE_STRING)) {
+                       os_free(opensc_engine_path);
                        opensc_engine_path = os_strdup(entry.str_value);
                        if (opensc_engine_path == NULL)
                                goto error;
                } else if (!strcmp(entry.key, "pkcs11_engine_path") &&
                           (entry.type == DBUS_TYPE_STRING)) {
+                       os_free(pkcs11_engine_path);
                        pkcs11_engine_path = os_strdup(entry.str_value);
                        if (pkcs11_engine_path == NULL)
                                goto error;
                } else if (!strcmp(entry.key, "pkcs11_module_path") &&
                                 (entry.type == DBUS_TYPE_STRING)) {
+                       os_free(pkcs11_module_path);
                        pkcs11_module_path = os_strdup(entry.str_value);
                        if (pkcs11_module_path == NULL)
                                goto error;