diff options
| -rw-r--r-- | dbus/dbus-message.c | 2 | ||||
| -rwxr-xr-x | dbus/dbus-transport-kdbus.c | 14 |
2 files changed, 15 insertions, 1 deletions
diff --git a/dbus/dbus-message.c b/dbus/dbus-message.c index 0e3f323b..4a1f7949 100644 --- a/dbus/dbus-message.c +++ b/dbus/dbus-message.c @@ -4340,6 +4340,8 @@ load_message (DBusMessageLoader *loader, { if (_dbus_message_is_gvariant (message)) { + type_str = NULL; + type_pos = 0; validity = _dbus_validate_gvariant_body_with_reason (type_str, type_pos, byte_order, diff --git a/dbus/dbus-transport-kdbus.c b/dbus/dbus-transport-kdbus.c index 893a3eff..099b8b32 100755 --- a/dbus/dbus-transport-kdbus.c +++ b/dbus/dbus-transport-kdbus.c @@ -1034,6 +1034,13 @@ kdbus_write_msg_internal (DBusTransportKdbus *transport, /* alloc palce for fds */ fds = dbus_malloc (sizeof (int) * (n_fds + 1)); + if (fds == NULL) + { + ret_size = -1; + kdbus_close_message (transport, msg_reply); + dbus_free (data); + goto out; + } /* decode dbus message */ ret = kdbus_decode_dbus_message (msg_reply, data, @@ -1042,6 +1049,7 @@ kdbus_write_msg_internal (DBusTransportKdbus *transport, { ret_size = -1; kdbus_close_message (transport, msg_reply); + dbus_free (fds); dbus_free (data); goto out; } @@ -2162,7 +2170,11 @@ reply_listNames (DBusTransportKdbus *transport, if (!dbus_message_iter_append_basic (&array_iter, DBUS_TYPE_STRING, &name_ptr)) - goto oom_iterator; + { + if (flags & KDBUS_LIST_QUEUED) + free (name_ptr); + goto oom_iterator; + } if (flags & KDBUS_LIST_QUEUED) free (name_ptr); |