commit 46b28ccee1c2411dd3611969a842e6d23cc7460d
author Gohulan Balachandran <gohulanb@quicinc.com> Fri Oct 20 09:37:52 2017 -0700
committer Naveen Kalla <mrnaveen@google.com> Thu Dec 14 02:19:21 2017 +0000
tree 847611370ab2f7e110ffe532f7fcaf4c469c7df1
parent 3404904b580b86c9c143d1978f19ecd199e9692b

Fix double freeing of memory in SAP service and add null-checks.

The payload of a SAP request could be freed twice in certain scenarios.
Also, add null-checks to prevent dereferencing of null pointers.

Bug: 64729356
Test: Manually run the fuzz tests and ensure that there is no crash in
      rild

Change-Id: Ib7ae269fa5297d6acea267337b220b8858c82bae

libril/sap_service.cpp

diff --git a/libril/sap_service.cpp b/libril/sap_service.cpp
index b945174..cd5b137 100644
--- a/libril/sap_service.cpp
+++ b/libril/sap_service.cpp
@@ -106,11 +106,13 @@
 
 Return<void> SapImpl::addPayloadAndDispatchRequest(MsgHeader *msg, uint16_t reqLen,
         uint8_t *reqPtr) {
-    msg->payload = (pb_bytes_array_t *)malloc(sizeof(pb_bytes_array_t) - 1 + reqLen);
-    if (msg->payload == NULL) {
+    pb_bytes_array_t *payload = (pb_bytes_array_t *) malloc(sizeof(pb_bytes_array_t) - 1 + reqLen);
+    if (payload == NULL) {
         sendFailedResponse(msg->id, msg->token, 2, reqPtr, msg);
         return Void();
     }
+
+    msg->payload = payload;
     msg->payload->size = reqLen;
     memcpy(msg->payload->bytes, reqPtr, reqLen);
 
@@ -120,7 +122,7 @@
         sapSocket->dispatchRequest(msg);
     } else {
         RLOGE("SapImpl::addPayloadAndDispatchRequest: sapSocket is null");
-        sendFailedResponse(msg->id, msg->token, 3, msg->payload, reqPtr, msg);
+        sendFailedResponse(msg->id, msg->token, 3, payload, reqPtr, msg);
         return Void();
     }
     free(msg->payload);