Related: rhbz#1602589 double_free, convert to std::vector

Change-Id: I5fa19422d7ee61e7aad74eae86d843072e94016c
Reviewed-on: https://gerrit.libreoffice.org/58087
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 39 insertions, 71 deletions

diff --git a/registry/source/regimpl.cxx b/registry/source/regimpl.cxx
index 0bb4b2126ffa..79279b1f3f90 100644
--- a/registry/source/regimpl.cxx
+++ b/registry/source/regimpl.cxx
@@ -21,6 +21,7 @@
 #include "regimpl.hxx"
 
 #include <memory>
+#include <vector>
 #include <string.h>
 #include <stdio.h>
 
@@ -903,7 +904,6 @@ RegError ORegistry::loadAndSaveValue(ORegKey* pTargetKey,
                                      bool bReport)
 {
     OStoreStream    rValue;
-    sal_uInt8*      pBuffer;
     RegValueType    valueType;
     sal_uInt32      valueSize;
     sal_uInt32      nSize;
@@ -937,37 +937,32 @@ RegError ORegistry::loadAndSaveValue(ORegKey* pTargetKey,
         return RegError::VALUE_NOT_EXISTS;
     }
 
-    pBuffer = static_cast<sal_uInt8*>(rtl_allocateMemory(VALUE_HEADERSIZE));
+    std::vector<sal_uInt8> aBuffer(VALUE_HEADERSIZE);
 
     sal_uInt32  rwBytes;
-    if (rValue.readAt(0, pBuffer, VALUE_HEADERSIZE, rwBytes))
+    if (rValue.readAt(0, aBuffer.data(), VALUE_HEADERSIZE, rwBytes))
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
     if (rwBytes != VALUE_HEADERSIZE)
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
 
     RegError _ret = RegError::NO_ERROR;
-    sal_uInt8   type = *pBuffer;
+    sal_uInt8   type = aBuffer[0];
     valueType = static_cast<RegValueType>(type);
-    readUINT32(pBuffer+VALUE_TYPEOFFSET, valueSize);
-    rtl_freeMemory(pBuffer);
+    readUINT32(aBuffer.data() + VALUE_TYPEOFFSET, valueSize);
 
     nSize = VALUE_HEADERSIZE + valueSize;
-    pBuffer = static_cast<sal_uInt8*>(rtl_allocateMemory(nSize));
+    aBuffer.resize(nSize);
 
-    if (rValue.readAt(0, pBuffer, nSize, rwBytes))
+    if (rValue.readAt(0, aBuffer.data(), nSize, rwBytes))
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
     if (rwBytes != nSize)
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
 
@@ -978,19 +973,17 @@ RegError ORegistry::loadAndSaveValue(ORegKey* pTargetKey,
         if (valueType == RegValueType::BINARY)
         {
             _ret = checkBlop(
-                rValue, sTargetPath, valueSize, pBuffer+VALUE_HEADEROFFSET,
+                rValue, sTargetPath, valueSize, aBuffer.data() + VALUE_HEADEROFFSET,
                 bReport);
             if (_ret != RegError::NO_ERROR)
             {
                 if (_ret == RegError::MERGE_ERROR ||
                     (_ret == RegError::MERGE_CONFLICT && bWarnings))
                 {
-                    rtl_freeMemory(pBuffer);
                     return _ret;
                 }
             } else
             {
-                rtl_freeMemory(pBuffer);
                 return _ret;
             }
         }
@@ -998,23 +991,19 @@ RegError ORegistry::loadAndSaveValue(ORegKey* pTargetKey,
 
     if (rValue.create(rTargetFile, sTargetPath, valueName, storeAccessMode::Create))
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
-    if (rValue.writeAt(0, pBuffer, nSize, rwBytes))
+    if (rValue.writeAt(0, aBuffer.data(), nSize, rwBytes))
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
 
     if (rwBytes != nSize)
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
     pTargetKey->setModified();
 
-    rtl_freeMemory(pBuffer);
     return _ret;
 }
 
@@ -1031,33 +1020,30 @@ RegError ORegistry::checkBlop(OStoreStream& rValue,
         return RegError::INVALID_VALUE;
     }
 
-    sal_uInt8*      pBuffer = static_cast<sal_uInt8*>(rtl_allocateMemory(VALUE_HEADERSIZE));
+    std::vector<sal_uInt8> aBuffer(VALUE_HEADERSIZE);
     RegValueType    valueType;
     sal_uInt32      valueSize;
     sal_uInt32      rwBytes;
     OString         targetPath(OUStringToOString(sTargetPath, RTL_TEXTENCODING_UTF8));
 
-    if (!rValue.readAt(0, pBuffer, VALUE_HEADERSIZE, rwBytes) &&
+    if (!rValue.readAt(0, aBuffer.data(), VALUE_HEADERSIZE, rwBytes) &&
         (rwBytes == VALUE_HEADERSIZE))
     {
-        sal_uInt8 type = *pBuffer;
+        sal_uInt8 type = aBuffer[0];
         valueType = static_cast<RegValueType>(type);
-        readUINT32(pBuffer+VALUE_TYPEOFFSET, valueSize);
-        rtl_freeMemory(pBuffer);
+        readUINT32(aBuffer.data() + VALUE_TYPEOFFSET, valueSize);
 
         if (valueType == RegValueType::BINARY)
         {
-            pBuffer = static_cast<sal_uInt8*>(rtl_allocateMemory(valueSize));
-            if (!rValue.readAt(VALUE_HEADEROFFSET, pBuffer, valueSize, rwBytes) &&
+            aBuffer.resize(valueSize);
+            if (!rValue.readAt(VALUE_HEADEROFFSET, aBuffer.data(), valueSize, rwBytes) &&
                 (rwBytes == valueSize))
             {
-                RegistryTypeReader reader2(pBuffer, valueSize);
+                RegistryTypeReader reader2(aBuffer.data(), valueSize);
 
                 if ((reader.getTypeClass() != reader2.getTypeClass())
                     || reader2.getTypeClass() == RT_TYPE_INVALID)
                 {
-                    rtl_freeMemory(pBuffer);
-
                     if (bReport)
                     {
                         fprintf(stdout, "ERROR: values of blop from key \"%s\" has different types.\n",
@@ -1073,22 +1059,17 @@ RegError ORegistry::checkBlop(OStoreStream& rValue,
                     {
                         mergeModuleValue(rValue, reader, reader2);
 
-                        rtl_freeMemory(pBuffer);
                         return RegError::NO_ERROR;
                     } else
                     if (reader2.getFieldCount() > 0)
                     {
-                        rtl_freeMemory(pBuffer);
                         return RegError::NO_ERROR;
                     } else
                     {
-                        rtl_freeMemory(pBuffer);
                         return RegError::MERGE_CONFLICT;
                     }
                 } else
                 {
-                    rtl_freeMemory(pBuffer);
-
                     if (bReport)
                     {
                         fprintf(stderr, "WARNING: value of key \"%s\" already exists.\n",
@@ -1098,7 +1079,6 @@ RegError ORegistry::checkBlop(OStoreStream& rValue,
                 }
             } else
             {
-                rtl_freeMemory(pBuffer);
                 if (bReport)
                 {
                     fprintf(stderr, "ERROR: values of key \"%s\" contains bad data.\n",
@@ -1108,7 +1088,6 @@ RegError ORegistry::checkBlop(OStoreStream& rValue,
             }
         } else
         {
-            rtl_freeMemory(pBuffer);
             if (bReport)
             {
                 fprintf(stderr, "ERROR: values of key \"%s\" has different types.\n",
@@ -1118,7 +1097,6 @@ RegError ORegistry::checkBlop(OStoreStream& rValue,
         }
     } else
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
 }
@@ -1190,26 +1168,22 @@ RegError ORegistry::mergeModuleValue(OStoreStream& rTargetValue,
         sal_uInt32          aBlopSize = writer.getBlopSize();
 
         sal_uInt8   type = sal_uInt8(RegValueType::BINARY);
-        sal_uInt8*  pBuffer = static_cast<sal_uInt8*>(rtl_allocateMemory(VALUE_HEADERSIZE + aBlopSize));
+        std::vector<sal_uInt8> aBuffer(VALUE_HEADERSIZE + aBlopSize);
 
-        memcpy(pBuffer, &type, 1);
-        writeUINT32(pBuffer+VALUE_TYPEOFFSET, aBlopSize);
-        memcpy(pBuffer+VALUE_HEADEROFFSET, pBlop, aBlopSize);
+        memcpy(aBuffer.data(), &type, 1);
+        writeUINT32(aBuffer.data() + VALUE_TYPEOFFSET, aBlopSize);
+        memcpy(aBuffer.data() + VALUE_HEADEROFFSET, pBlop, aBlopSize);
 
         sal_uInt32  rwBytes;
-        if (rTargetValue.writeAt(0, pBuffer, VALUE_HEADERSIZE+aBlopSize, rwBytes))
+        if (rTargetValue.writeAt(0, aBuffer.data(), VALUE_HEADERSIZE+aBlopSize, rwBytes))
         {
-            rtl_freeMemory(pBuffer);
             return RegError::INVALID_VALUE;
         }
 
         if (rwBytes != VALUE_HEADERSIZE+aBlopSize)
         {
-            rtl_freeMemory(pBuffer);
             return RegError::INVALID_VALUE;
         }
-
-        rtl_freeMemory(pBuffer);
     }
     return RegError::NO_ERROR;
 }
@@ -1325,7 +1299,6 @@ RegError ORegistry::dumpRegistry(RegKeyHandle hKey) const
 RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_Int16 nSpc) const
 {
     OStoreStream    rValue;
-    sal_uInt8*      pBuffer;
     sal_uInt32      valueSize;
     RegValueType    valueType;
     OUString        sFullPath(sPath);
@@ -1348,33 +1321,29 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
         return RegError::VALUE_NOT_EXISTS;
     }
 
-    pBuffer = static_cast<sal_uInt8*>(rtl_allocateMemory(VALUE_HEADERSIZE));
+    std::vector<sal_uInt8> aBuffer(VALUE_HEADERSIZE);
 
     sal_uInt32  rwBytes;
-    if (rValue.readAt(0, pBuffer, VALUE_HEADERSIZE, rwBytes))
+    if (rValue.readAt(0, aBuffer.data(), VALUE_HEADERSIZE, rwBytes))
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
     if (rwBytes != (VALUE_HEADERSIZE))
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
 
-    sal_uInt8 type = *pBuffer;
+    sal_uInt8 type = aBuffer[0];
     valueType = static_cast<RegValueType>(type);
-    readUINT32(pBuffer+VALUE_TYPEOFFSET, valueSize);
+    readUINT32(aBuffer.data() + VALUE_TYPEOFFSET, valueSize);
 
-    pBuffer = static_cast<sal_uInt8*>(rtl_allocateMemory(valueSize));
-    if (rValue.readAt(VALUE_HEADEROFFSET, pBuffer, valueSize, rwBytes))
+    aBuffer.resize(valueSize);
+    if (rValue.readAt(VALUE_HEADEROFFSET, aBuffer.data(), valueSize, rwBytes))
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
     if (rwBytes != valueSize)
     {
-        rtl_freeMemory(pBuffer);
         return RegError::INVALID_VALUE;
     }
 
@@ -1393,14 +1362,14 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
                 fprintf(stdout, "%s       Data = ", indent);
 
                 sal_Int32 value;
-                readINT32(pBuffer, value);
+                readINT32(aBuffer.data(), value);
                 fprintf(stdout, "%ld\n", sal::static_int_cast< long >(value));
             }
             break;
         case RegValueType::STRING:
             {
                 sal_Char* value = static_cast<sal_Char*>(rtl_allocateMemory(valueSize));
-                readUtf8(pBuffer, value, valueSize);
+                readUtf8(aBuffer.data(), value, valueSize);
                 fprintf(stdout, "%sValue: Type = RegValueType::STRING\n", indent);
                 fprintf(
                     stdout, "%s       Size = %lu\n", indent,
@@ -1419,7 +1388,7 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
                 fprintf(stdout, "%s       Data = ", indent);
 
                 std::unique_ptr<sal_Unicode[]> value(new sal_Unicode[size]);
-                readString(pBuffer, value.get(), size);
+                readString(aBuffer.data(), value.get(), size);
 
                 OString uStr = OUStringToOString(value.get(), RTL_TEXTENCODING_UTF8);
                 fprintf(stdout, "L\"%s\"\n", uStr.getStr());
@@ -1433,7 +1402,7 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
                     sal::static_int_cast< unsigned long >(valueSize));
                 fprintf(stdout, "%s       Data = ", indent);
                 dumpType(
-                    typereg::Reader(pBuffer, valueSize),
+                    typereg::Reader(aBuffer.data(), valueSize),
                     sIndent + "              ");
             }
             break;
@@ -1442,7 +1411,7 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
                 sal_uInt32 offset = 4; // initial 4 bytes for the size of the array
                 sal_uInt32 len = 0;
 
-                readUINT32(pBuffer, len);
+                readUINT32(aBuffer.data(), len);
 
                 fprintf(stdout, "%sValue: Type = RegValueType::LONGLIST\n", indent);
                 fprintf(
@@ -1456,7 +1425,7 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
                 sal_Int32 longValue;
                 for (sal_uInt32 i=0; i < len; i++)
                 {
-                    readINT32(pBuffer+offset, longValue);
+                    readINT32(aBuffer.data() + offset, longValue);
 
                     if (offset > 4)
                         fprintf(stdout, "%s              ", indent);
@@ -1475,7 +1444,7 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
                 sal_uInt32 sLen = 0;
                 sal_uInt32 len = 0;
 
-                readUINT32(pBuffer, len);
+                readUINT32(aBuffer.data(), len);
 
                 fprintf(stdout, "%sValue: Type = RegValueType::STRINGLIST\n", indent);
                 fprintf(
@@ -1488,12 +1457,12 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
 
                 for (sal_uInt32 i=0; i < len; i++)
                 {
-                    readUINT32(pBuffer+offset, sLen);
+                    readUINT32(aBuffer.data() + offset, sLen);
 
                     offset += 4; // 4 bytes (sal_uInt32) for the string size
 
                     sal_Char *pValue = static_cast<sal_Char*>(rtl_allocateMemory(sLen));
-                    readUtf8(pBuffer+offset, pValue, sLen);
+                    readUtf8(aBuffer.data() + offset, pValue, sLen);
 
                     if (offset > 8)
                         fprintf(stdout, "%s              ", indent);
@@ -1512,7 +1481,7 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
                 sal_uInt32 sLen = 0;
                 sal_uInt32 len = 0;
 
-                readUINT32(pBuffer, len);
+                readUINT32(aBuffer.data(), len);
 
                 fprintf(stdout, "%sValue: Type = RegValueType::UNICODELIST\n", indent);
                 fprintf(
@@ -1526,12 +1495,12 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
                 OString uStr;
                 for (sal_uInt32 i=0; i < len; i++)
                 {
-                    readUINT32(pBuffer+offset, sLen);
+                    readUINT32(aBuffer.data() + offset, sLen);
 
                     offset += 4; // 4 bytes (sal_uInt32) for the string size
 
                     sal_Unicode *pValue = static_cast<sal_Unicode*>(rtl_allocateMemory((sLen / 2) * sizeof(sal_Unicode)));
-                    readString(pBuffer+offset, pValue, sLen);
+                    readString(aBuffer.data() + offset, pValue, sLen);
 
                     if (offset > 8)
                         fprintf(stdout, "%s              ", indent);
@@ -1552,7 +1521,6 @@ RegError ORegistry::dumpValue(const OUString& sPath, const OUString& sName, sal_
 
     fprintf(stdout, "\n");
 
-    rtl_freeMemory(pBuffer);
     return RegError::NO_ERROR;
 }