Skip to content

Commit

Permalink
fix: events leak that can occur if allocation fails
Browse files Browse the repository at this point in the history
rare in practice, found by fuzzing
  • Loading branch information
Green-Sky committed Oct 9, 2024
1 parent 03e9fbf commit d0cd28b
Show file tree
Hide file tree
Showing 40 changed files with 161 additions and 41 deletions.
5 changes: 4 additions & 1 deletion other/event_tooling/generate_event_c.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -444,7 +444,10 @@ void generate_event_impl(const std::string& event_name, const std::vector<EventT
f << " Tox_Event event;\n";
f << " event.type = TOX_EVENT_" << str_toupper(event_name) << ";\n";
f << " event.data." << event_name_l << " = " << event_name_l << ";\n\n";
f << " tox_events_add(events, &event);\n";
f << " if (!tox_events_add(events, &event)) {\n";
f << " tox_event_" << event_name_l << "_free(" << event_name_l << ", mem);\n";
f << " return nullptr;\n";
f << " }\n";
f << " return " << event_name_l << ";\n}\n\n";

// unpack
Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/conference_connected.c
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,10 @@ static Tox_Event_Conference_Connected *tox_events_add_conference_connected(Tox_E
event.type = TOX_EVENT_CONFERENCE_CONNECTED;
event.data.conference_connected = conference_connected;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_conference_connected_free(conference_connected, mem);
return nullptr;
}
return conference_connected;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/conference_invite.c
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,10 @@ static Tox_Event_Conference_Invite *tox_events_add_conference_invite(Tox_Events
event.type = TOX_EVENT_CONFERENCE_INVITE;
event.data.conference_invite = conference_invite;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_conference_invite_free(conference_invite, mem);
return nullptr;
}
return conference_invite;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/conference_message.c
Original file line number Diff line number Diff line change
Expand Up @@ -193,7 +193,10 @@ static Tox_Event_Conference_Message *tox_events_add_conference_message(Tox_Event
event.type = TOX_EVENT_CONFERENCE_MESSAGE;
event.data.conference_message = conference_message;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_conference_message_free(conference_message, mem);
return nullptr;
}
return conference_message;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/conference_peer_list_changed.c
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,10 @@ static Tox_Event_Conference_Peer_List_Changed *tox_events_add_conference_peer_li
event.type = TOX_EVENT_CONFERENCE_PEER_LIST_CHANGED;
event.data.conference_peer_list_changed = conference_peer_list_changed;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_conference_peer_list_changed_free(conference_peer_list_changed, mem);
return nullptr;
}
return conference_peer_list_changed;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/conference_peer_name.c
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,10 @@ static Tox_Event_Conference_Peer_Name *tox_events_add_conference_peer_name(Tox_E
event.type = TOX_EVENT_CONFERENCE_PEER_NAME;
event.data.conference_peer_name = conference_peer_name;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_conference_peer_name_free(conference_peer_name, mem);
return nullptr;
}
return conference_peer_name;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/conference_title.c
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,10 @@ static Tox_Event_Conference_Title *tox_events_add_conference_title(Tox_Events *e
event.type = TOX_EVENT_CONFERENCE_TITLE;
event.data.conference_title = conference_title;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_conference_title_free(conference_title, mem);
return nullptr;
}
return conference_title;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/file_chunk_request.c
Original file line number Diff line number Diff line change
Expand Up @@ -162,7 +162,10 @@ static Tox_Event_File_Chunk_Request *tox_events_add_file_chunk_request(Tox_Event
event.type = TOX_EVENT_FILE_CHUNK_REQUEST;
event.data.file_chunk_request = file_chunk_request;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_file_chunk_request_free(file_chunk_request, mem);
return nullptr;
}
return file_chunk_request;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/file_recv.c
Original file line number Diff line number Diff line change
Expand Up @@ -207,7 +207,10 @@ static Tox_Event_File_Recv *tox_events_add_file_recv(Tox_Events *events, const M
event.type = TOX_EVENT_FILE_RECV;
event.data.file_recv = file_recv;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_file_recv_free(file_recv, mem);
return nullptr;
}
return file_recv;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/file_recv_chunk.c
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,10 @@ static Tox_Event_File_Recv_Chunk *tox_events_add_file_recv_chunk(Tox_Events *eve
event.type = TOX_EVENT_FILE_RECV_CHUNK;
event.data.file_recv_chunk = file_recv_chunk;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_file_recv_chunk_free(file_recv_chunk, mem);
return nullptr;
}
return file_recv_chunk;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/file_recv_control.c
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,10 @@ static Tox_Event_File_Recv_Control *tox_events_add_file_recv_control(Tox_Events
event.type = TOX_EVENT_FILE_RECV_CONTROL;
event.data.file_recv_control = file_recv_control;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_file_recv_control_free(file_recv_control, mem);
return nullptr;
}
return file_recv_control;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/friend_connection_status.c
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,10 @@ static Tox_Event_Friend_Connection_Status *tox_events_add_friend_connection_stat
event.type = TOX_EVENT_FRIEND_CONNECTION_STATUS;
event.data.friend_connection_status = friend_connection_status;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_friend_connection_status_free(friend_connection_status, mem);
return nullptr;
}
return friend_connection_status;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/friend_lossless_packet.c
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,10 @@ static Tox_Event_Friend_Lossless_Packet *tox_events_add_friend_lossless_packet(T
event.type = TOX_EVENT_FRIEND_LOSSLESS_PACKET;
event.data.friend_lossless_packet = friend_lossless_packet;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_friend_lossless_packet_free(friend_lossless_packet, mem);
return nullptr;
}
return friend_lossless_packet;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/friend_lossy_packet.c
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,10 @@ static Tox_Event_Friend_Lossy_Packet *tox_events_add_friend_lossy_packet(Tox_Eve
event.type = TOX_EVENT_FRIEND_LOSSY_PACKET;
event.data.friend_lossy_packet = friend_lossy_packet;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_friend_lossy_packet_free(friend_lossy_packet, mem);
return nullptr;
}
return friend_lossy_packet;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/friend_message.c
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,10 @@ static Tox_Event_Friend_Message *tox_events_add_friend_message(Tox_Events *event
event.type = TOX_EVENT_FRIEND_MESSAGE;
event.data.friend_message = friend_message;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_friend_message_free(friend_message, mem);
return nullptr;
}
return friend_message;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/friend_name.c
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,10 @@ static Tox_Event_Friend_Name *tox_events_add_friend_name(Tox_Events *events, con
event.type = TOX_EVENT_FRIEND_NAME;
event.data.friend_name = friend_name;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_friend_name_free(friend_name, mem);
return nullptr;
}
return friend_name;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/friend_read_receipt.c
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,10 @@ static Tox_Event_Friend_Read_Receipt *tox_events_add_friend_read_receipt(Tox_Eve
event.type = TOX_EVENT_FRIEND_READ_RECEIPT;
event.data.friend_read_receipt = friend_read_receipt;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_friend_read_receipt_free(friend_read_receipt, mem);
return nullptr;
}
return friend_read_receipt;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/friend_request.c
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,10 @@ static Tox_Event_Friend_Request *tox_events_add_friend_request(Tox_Events *event
event.type = TOX_EVENT_FRIEND_REQUEST;
event.data.friend_request = friend_request;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_friend_request_free(friend_request, mem);
return nullptr;
}
return friend_request;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/friend_status.c
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,10 @@ static Tox_Event_Friend_Status *tox_events_add_friend_status(Tox_Events *events,
event.type = TOX_EVENT_FRIEND_STATUS;
event.data.friend_status = friend_status;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_friend_status_free(friend_status, mem);
return nullptr;
}
return friend_status;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/friend_status_message.c
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,10 @@ static Tox_Event_Friend_Status_Message *tox_events_add_friend_status_message(Tox
event.type = TOX_EVENT_FRIEND_STATUS_MESSAGE;
event.data.friend_status_message = friend_status_message;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_friend_status_message_free(friend_status_message, mem);
return nullptr;
}
return friend_status_message;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/friend_typing.c
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,10 @@ static Tox_Event_Friend_Typing *tox_events_add_friend_typing(Tox_Events *events,
event.type = TOX_EVENT_FRIEND_TYPING;
event.data.friend_typing = friend_typing;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_friend_typing_free(friend_typing, mem);
return nullptr;
}
return friend_typing;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_custom_packet.c
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,10 @@ static Tox_Event_Group_Custom_Packet *tox_events_add_group_custom_packet(Tox_Eve
event.type = TOX_EVENT_GROUP_CUSTOM_PACKET;
event.data.group_custom_packet = group_custom_packet;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_custom_packet_free(group_custom_packet, mem);
return nullptr;
}
return group_custom_packet;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_custom_private_packet.c
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,10 @@ static Tox_Event_Group_Custom_Private_Packet *tox_events_add_group_custom_privat
event.type = TOX_EVENT_GROUP_CUSTOM_PRIVATE_PACKET;
event.data.group_custom_private_packet = group_custom_private_packet;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_custom_private_packet_free(group_custom_private_packet, mem);
return nullptr;
}
return group_custom_private_packet;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_invite.c
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,10 @@ static Tox_Event_Group_Invite *tox_events_add_group_invite(Tox_Events *events, c
event.type = TOX_EVENT_GROUP_INVITE;
event.data.group_invite = group_invite;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_invite_free(group_invite, mem);
return nullptr;
}
return group_invite;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_join_fail.c
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,10 @@ static Tox_Event_Group_Join_Fail *tox_events_add_group_join_fail(Tox_Events *eve
event.type = TOX_EVENT_GROUP_JOIN_FAIL;
event.data.group_join_fail = group_join_fail;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_join_fail_free(group_join_fail, mem);
return nullptr;
}
return group_join_fail;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_message.c
Original file line number Diff line number Diff line change
Expand Up @@ -209,7 +209,10 @@ static Tox_Event_Group_Message *tox_events_add_group_message(Tox_Events *events,
event.type = TOX_EVENT_GROUP_MESSAGE;
event.data.group_message = group_message;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_message_free(group_message, mem);
return nullptr;
}
return group_message;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_moderation.c
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,10 @@ static Tox_Event_Group_Moderation *tox_events_add_group_moderation(Tox_Events *e
event.type = TOX_EVENT_GROUP_MODERATION;
event.data.group_moderation = group_moderation;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_moderation_free(group_moderation, mem);
return nullptr;
}
return group_moderation;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_password.c
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,10 @@ static Tox_Event_Group_Password *tox_events_add_group_password(Tox_Events *event
event.type = TOX_EVENT_GROUP_PASSWORD;
event.data.group_password = group_password;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_password_free(group_password, mem);
return nullptr;
}
return group_password;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_peer_exit.c
Original file line number Diff line number Diff line change
Expand Up @@ -237,7 +237,10 @@ static Tox_Event_Group_Peer_Exit *tox_events_add_group_peer_exit(Tox_Events *eve
event.type = TOX_EVENT_GROUP_PEER_EXIT;
event.data.group_peer_exit = group_peer_exit;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_peer_exit_free(group_peer_exit, mem);
return nullptr;
}
return group_peer_exit;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_peer_join.c
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,10 @@ static Tox_Event_Group_Peer_Join *tox_events_add_group_peer_join(Tox_Events *eve
event.type = TOX_EVENT_GROUP_PEER_JOIN;
event.data.group_peer_join = group_peer_join;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_peer_join_free(group_peer_join, mem);
return nullptr;
}
return group_peer_join;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_peer_limit.c
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,10 @@ static Tox_Event_Group_Peer_Limit *tox_events_add_group_peer_limit(Tox_Events *e
event.type = TOX_EVENT_GROUP_PEER_LIMIT;
event.data.group_peer_limit = group_peer_limit;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_peer_limit_free(group_peer_limit, mem);
return nullptr;
}
return group_peer_limit;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_peer_name.c
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,10 @@ static Tox_Event_Group_Peer_Name *tox_events_add_group_peer_name(Tox_Events *eve
event.type = TOX_EVENT_GROUP_PEER_NAME;
event.data.group_peer_name = group_peer_name;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_peer_name_free(group_peer_name, mem);
return nullptr;
}
return group_peer_name;
}

Expand Down
5 changes: 4 additions & 1 deletion toxcore/events/group_peer_status.c
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,10 @@ static Tox_Event_Group_Peer_Status *tox_events_add_group_peer_status(Tox_Events
event.type = TOX_EVENT_GROUP_PEER_STATUS;
event.data.group_peer_status = group_peer_status;

tox_events_add(events, &event);
if (!tox_events_add(events, &event)) {
tox_event_group_peer_status_free(group_peer_status, mem);
return nullptr;
}
return group_peer_status;
}

Expand Down
Loading

0 comments on commit d0cd28b

Please sign in to comment.