[PATCH 0/7] iw: various bug fixes

[PATCH 0/7] iw: various bug fixes

[John Crispin]

These fixes were extracted from the latest Intel/UGW. I am assuming they
ran static code analyses/Klocwork in the source.

John Crispin (7):
  iw: fix memory leak inside register_mgmt_frame
  iw: fix endless loop inside handle_mgmt_dump
  iw: fix memory leak inside handle_cac
  iw: fix fd leak inside handle_netns
  iw: fix memory leak inside parse_sched_scan
  iw: fix memory leaks inside handle_scan
  iw: fix fp handling inside handle_vendor

 mgmt.c   |  4 ++++
 phy.c    | 25 ++++++++++++++++++-------
 scan.c   | 34 +++++++++++++++++-----------------
 vendor.c |  5 ++++-
 4 files changed, 43 insertions(+), 25 deletions(-)

-- 
2.20.1

[PATCH 1/7] iw: fix memory leak inside register_mgmt_frame

[John Crispin]

Signed-off-by: John Crispin <john@phrozen.org>
---
 mgmt.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mgmt.c b/mgmt.c
index 60f544b..88fe3fd 100644
--- a/mgmt.c
+++ b/mgmt.c
@@ -69,9 +69,11 @@ static int register_mgmt_frame(struct nl80211_state *state,
 	NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
 	NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
 
+	free(match);
 	return 0;
 
 nla_put_failure:
+	free(match);
 	return -ENOBUFS;
 }
 
-- 
2.20.1

[PATCH 2/7] iw: fix endless loop inside handle_mgmt_dump

[John Crispin]

passing -1 will break the while loop further down in the code.

Signed-off-by: John Crispin <john@phrozen.org>
---
 mgmt.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mgmt.c b/mgmt.c
index 88fe3fd..338435d 100644
--- a/mgmt.c
+++ b/mgmt.c
@@ -109,6 +109,8 @@ static int handle_mgmt_dump(struct nl80211_state *state,
 	for (i = 3; i < argc; i += 3) {
 		if (strcmp(argv[i], "count") == 0) {
 			count = 1 + atoi(argv[i + 1]);
+			if (count < 1)
+				count = 1;
 			break;
 		}
 
-- 
2.20.1

[PATCH 3/7] iw: fix memory leak inside handle_cac

[John Crispin]

Signed-off-by: John Crispin <john@phrozen.org>
---
 phy.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/phy.c b/phy.c
index 77df7a7..a4425ea 100644
--- a/phy.c
+++ b/phy.c
@@ -328,12 +328,15 @@ static int handle_cac(struct nl80211_state *state,
 	} else if (strcmp(argv[2], "freq") == 0) {
 		err = parse_freqchan(&chandef, false, argc - 3, argv + 3, NULL);
 	} else {
-		return 1;
+		err = 1;
+		goto err_out;
 	}
 
 	cac_trigger_argv = calloc(argc + 1, sizeof(char*));
-	if (!cac_trigger_argv)
-		return -ENOMEM;
+	if (!cac_trigger_argv) {
+		err = -ENOMEM;
+		goto err_out;
+	}
 
 	cac_trigger_argv[0] = argv[0];
 	cac_trigger_argv[1] = "cac";
@@ -341,9 +344,8 @@ static int handle_cac(struct nl80211_state *state,
 	memcpy(&cac_trigger_argv[3], &argv[2], (argc - 2) * sizeof(char*));
 
 	err = handle_cmd(state, id, argc + 1, cac_trigger_argv);
-	free(cac_trigger_argv);
 	if (err)
-		return err;
+		goto err_out;
 
 	cac_event.ret = 1;
 	cac_event.freq = chandef.control_freq;
@@ -357,7 +359,13 @@ static int handle_cac(struct nl80211_state *state,
 	while (cac_event.ret > 0)
 		nl_recvmsgs(state->nl_sock, radar_cb);
 
-	return 0;
+	err = 0;
+err_out:
+	if (radar_cb)
+		nl_cb_put(radar_cb);
+	if (cac_trigger_argv)
+		free(cac_trigger_argv);
+	return err;
 }
 TOPLEVEL(cac, "channel <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
 	      "freq <freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
-- 
2.20.1

[PATCH 4/7] iw: fix fd leak inside handle_netns

[John Crispin]

Signed-off-by: John Crispin <john@phrozen.org>
---
 phy.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/phy.c b/phy.c
index a4425ea..ba89d46 100644
--- a/phy.c
+++ b/phy.c
@@ -1,6 +1,7 @@
 #include <stdbool.h>
 #include <errno.h>
 #include <strings.h>
+#include <unistd.h>
 #include <sys/param.h>
 #include <sys/stat.h>
 #include <fcntl.h>
@@ -531,7 +532,7 @@ static int handle_netns(struct nl80211_state *state,
 			enum id_input id)
 {
 	char *end;
-	int fd;
+	int fd = -1;
 
 	if (argc < 1 || !*argv[0])
 		return 1;
@@ -559,6 +560,8 @@ static int handle_netns(struct nl80211_state *state,
 	return 1;
 
  nla_put_failure:
+	if (fd >= 0)
+		close(fd);
 	return -ENOBUFS;
 }
 COMMAND(set, netns, "{ <pid> | name <nsname> }",
-- 
2.20.1

[PATCH 5/7] iw: fix memory leak inside parse_sched_scan

[John Crispin]

Signed-off-by: John Crispin <john@phrozen.org>
---
 scan.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scan.c b/scan.c
index b0b7828..980bfb4 100644
--- a/scan.c
+++ b/scan.c
@@ -355,11 +355,12 @@ int parse_sched_scan(struct nl_msg *msg, int *argc, char ***argv)
 nla_put_failure:
 	if (match)
 		nla_nest_end(msg, match);
+out:
 	nlmsg_free(freqs);
 	nlmsg_free(matchset);
 	nlmsg_free(scan_plans);
+	nlmsg_free(ssids);
 
-out:
 	*argc = c;
 	*argv = v;
 	return err;
-- 
2.20.1

[PATCH 6/7] iw: fix memory leaks inside handle_scan

[John Crispin]

Signed-off-by: John Crispin <john@phrozen.org>
---
 scan.c | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/scan.c b/scan.c
index 980bfb4..6ad3ad4 100644
--- a/scan.c
+++ b/scan.c
@@ -389,7 +389,7 @@ static int handle_scan(struct nl80211_state *state,
 	bool passive = false, have_ssids = false, have_freqs = false;
 	bool duration_mandatory = false;
 	size_t ies_len = 0, meshid_len = 0;
-	unsigned char *ies = NULL, *meshid = NULL, *tmpies;
+	unsigned char *ies = NULL, *meshid = NULL, *tmpies = NULL;
 	unsigned int flags = 0;
 
 	ssids = nlmsg_alloc();
@@ -450,7 +450,8 @@ static int handle_scan(struct nl80211_state *state,
 		case DONE:
 			nlmsg_free(ssids);
 			nlmsg_free(freqs);
-			return 1;
+			err = 1;
+			goto nla_put_failure;
 		case FREQ:
 			freq = strtoul(argv[i], &eptr, 10);
 			if (eptr != argv[i] + strlen(argv[i])) {
@@ -462,6 +463,8 @@ static int handle_scan(struct nl80211_state *state,
 			NLA_PUT_U32(freqs, i, freq);
 			break;
 		case IES:
+			if (ies)
+				free(ies);
 			ies = parse_hex(argv[i], &ies_len);
 			if (!ies)
 				goto nla_put_failure;
@@ -490,24 +493,14 @@ static int handle_scan(struct nl80211_state *state,
 
 	if (ies || meshid) {
 		tmpies = (unsigned char *) malloc(ies_len + meshid_len);
-		if (!tmpies) {
-			free(ies);
-			free(meshid);
+		if (!tmpies)
 			goto nla_put_failure;
-		}
-		if (ies) {
+		if (ies)
 			memcpy(tmpies, ies, ies_len);
-			free(ies);
-		}
-		if (meshid) {
+		if (meshid)
 			memcpy(&tmpies[ies_len], meshid, meshid_len);
-			free(meshid);
-		}
-		if (nla_put(msg, NL80211_ATTR_IE, ies_len + meshid_len, tmpies) < 0) {
-			free(tmpies);
+		if (nla_put(msg, NL80211_ATTR_IE, ies_len + meshid_len, tmpies) < 0)
 			goto nla_put_failure;
-		}
-		free(tmpies);
 	}
 
 	if (!have_ssids)
@@ -535,6 +528,12 @@ static int handle_scan(struct nl80211_state *state,
  nla_put_failure:
 	nlmsg_free(ssids);
 	nlmsg_free(freqs);
+	if (meshid)
+		free(meshid);
+	if (ies)
+		free(ies);
+	if (tmpies)
+		free(tmpies);
 	return err;
 }
 
-- 
2.20.1

[PATCH 7/7] iw: fix fp handling inside handle_vendor

[John Crispin]

The fp can leak and should not be closed if we do i/o redirection.

Signed-off-by: John Crispin <john@phrozen.org>
---
 vendor.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/vendor.c b/vendor.c
index 860cd48..d203d85 100644
--- a/vendor.c
+++ b/vendor.c
@@ -107,7 +107,8 @@ static int handle_vendor(struct nl80211_state *state,
 
 	if (file) {
 		count = read_file(file, buf, sizeof(buf));
-		fclose(file);
+		if (file != stdin)
+			fclose(file);
 	} else
 		count = read_hex(argc - 2, &argv[2], buf, sizeof(buf));
 
@@ -120,6 +121,8 @@ static int handle_vendor(struct nl80211_state *state,
 	return 0;
 
 nla_put_failure:
+	if (file && file != stdin)
+		fclose(file);
 	return -ENOBUFS;
 }
 
-- 
2.20.1