From a1a2fe5d13ad76956a94c0695af15d76e3edfdca Mon Sep 17 00:00:00 2001 From: fujiwarat Date: Thu, 18 Jul 2024 01:25:41 +0900 Subject: [PATCH] Fix memory leaks in error handlings - bus/ibusimpl: Free keys not in case of TYPE_IME_SWITCHER - src/ibuscomposetable: Correct handling G_MAXSIZE * G_MAXSIZE - src/ibuscomposetable: Fee ibus_compose_seqs in error handlings --- bus/ibusimpl.c | 3 ++- src/ibuscomposetable.c | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/bus/ibusimpl.c b/bus/ibusimpl.c index 31a095f3..445c062b 100644 --- a/bus/ibusimpl.c +++ b/bus/ibusimpl.c @@ -1986,7 +1986,8 @@ _ibus_set_global_shortcut_keys (BusIBusImpl *ibus, } ibus->ime_switcher_keys = keys; break; - default:; + default: + g_slice_free1 (sizeof (IBusProcessKeyEventData) * (size + 1), keys); } return TRUE; } diff --git a/src/ibuscomposetable.c b/src/ibuscomposetable.c index 7531a4b2..a8e41a33 100644 --- a/src/ibuscomposetable.c +++ b/src/ibuscomposetable.c @@ -849,7 +849,7 @@ compose_data_to_variant (gconstpointer compose_data, g_assert (compose_data); if (error) *error = NULL; - if ((index_stride * n_seqs) > G_MAXUINT64) { + if (n_seqs == 0 || index_stride > (G_MAXSIZE / n_seqs)) { if (error) { g_set_error (error, IBUS_ERROR, IBUS_ERROR_FAILED, "Length %u x %lu is too long", @@ -1404,6 +1404,7 @@ ibus_compose_table_new_with_list (GList *compose_list, (G_MAXSIZE / sizeof (guint16)))) { g_warning ("Too long allocation %lu x %u", s_size_total - s_size_16bit, n_index_stride); + g_free (ibus_compose_seqs); return NULL; } rawdata = (gpointer)g_new ( @@ -1416,6 +1417,8 @@ ibus_compose_table_new_with_list (GList *compose_list, s_size_total - s_size_16bit, n_index_stride, v_size_32bit); + g_free (ibus_compose_seqs); + g_free (rawdata); return NULL; } if (G_LIKELY (rawdata)) { @@ -1432,6 +1435,7 @@ ibus_compose_table_new_with_list (GList *compose_list, } if (!ibus_compose_seqs_32bit_first || !ibus_compose_seqs_32bit_second) { g_warning ("Failed g_new"); + g_free (ibus_compose_seqs); g_free (rawdata); return NULL; } -- 2.45.0