From 3c8c127e0e629f4075287ad33e54d5c51b24eddb Mon Sep 17 00:00:00 2001
From: Christian Grothoff <christian@grothoff.org>
Date: Tue, 22 Sep 2015 10:00:01 +0200
Subject: fixing use of wrong array length (bad), and misc leaks

---
 src/mint/taler-mint-httpd_refresh.c | 94 ++++++++++++-------------------------
 1 file changed, 30 insertions(+), 64 deletions(-)

(limited to 'src/mint/taler-mint-httpd_refresh.c')

diff --git a/src/mint/taler-mint-httpd_refresh.c b/src/mint/taler-mint-httpd_refresh.c
index 29fd4baea..4d89fe892 100644
--- a/src/mint/taler-mint-httpd_refresh.c
+++ b/src/mint/taler-mint-httpd_refresh.c
@@ -417,10 +417,8 @@ handle_refresh_melt_json (struct MHD_Connection *connection,
                                    &denom_pubs[i].rsa_public_key);
     if (GNUNET_OK != res)
     {
-      for (j=0;j<i;j++)
-        GNUNET_CRYPTO_rsa_public_key_free (denom_pubs[j].rsa_public_key);
-      GNUNET_free (denom_pubs);
-      return res;
+      res = (GNUNET_NO == res) ? MHD_YES : MHD_NO;
+      goto cleanup_denoms;
     }
     buf_size = GNUNET_CRYPTO_rsa_public_key_encode (denom_pubs[i].rsa_public_key,
                                                     &buf);
@@ -444,16 +442,8 @@ handle_refresh_melt_json (struct MHD_Connection *connection,
     if (GNUNET_OK != res)
     {
       GNUNET_break_op (0);
-      for (j=0;j<i;j++)
-      {
-        GNUNET_CRYPTO_rsa_public_key_free (coin_melt_details[j].coin_info.denom_pub.rsa_public_key);
-        GNUNET_CRYPTO_rsa_signature_free (coin_melt_details[j].coin_info.denom_sig.rsa_signature);
-      }
-      for (j=0;j<num_new_denoms;j++)
-        GNUNET_CRYPTO_rsa_public_key_free (denom_pubs[j].rsa_public_key);
-      GNUNET_free (coin_melt_details);
-      GNUNET_free (denom_pubs);
-      return (GNUNET_NO == res) ? MHD_YES : MHD_NO;
+      res = (GNUNET_NO == res) ? MHD_YES : MHD_NO;
+      goto cleanup_melt_details;
     }
     /* Check that the client does not try to melt the same coin twice
        into the same session! */
@@ -464,17 +454,9 @@ handle_refresh_melt_json (struct MHD_Connection *connection,
                        sizeof (struct TALER_CoinSpendPublicKeyP)))
       {
         GNUNET_break_op (0);
-        for (j=0;j<i;j++)
-        {
-          GNUNET_CRYPTO_rsa_public_key_free (coin_melt_details[j].coin_info.denom_pub.rsa_public_key);
-          GNUNET_CRYPTO_rsa_signature_free (coin_melt_details[j].coin_info.denom_sig.rsa_signature);
-        }
-        for (j=0;j<num_new_denoms;j++)
-          GNUNET_CRYPTO_rsa_public_key_free (denom_pubs[j].rsa_public_key);
-        GNUNET_free (coin_melt_details);
-        GNUNET_free (denom_pubs);
-        return TMH_RESPONSE_reply_external_error (connection,
-                                                  "melting same coin twice in same session is not allowed");
+        res = TMH_RESPONSE_reply_external_error (connection,
+                                                 "melting same coin twice in same session is not allowed");
+        goto cleanup_melt_details;
       }
     }
     TALER_amount_hton (&melt_amount,
@@ -512,11 +494,8 @@ handle_refresh_melt_json (struct MHD_Connection *connection,
       if (GNUNET_OK != res)
       {
         GNUNET_break_op (0);
-        GNUNET_CRYPTO_hash_context_abort (hash_context);
-        free_commit_coins (commit_coin,
-                           TALER_CNC_KAPPA,
-                           num_newcoins);
-        return (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
+        res = (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
+        goto cleanup;
       }
 
       GNUNET_CRYPTO_hash_context_read (hash_context,
@@ -532,11 +511,8 @@ handle_refresh_melt_json (struct MHD_Connection *connection,
       if (GNUNET_OK != res)
       {
         GNUNET_break_op (0);
-        GNUNET_CRYPTO_hash_context_abort (hash_context);
-        free_commit_coins (commit_coin,
-                           TALER_CNC_KAPPA,
-                           num_newcoins);
-        return (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
+        res = (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
+        goto cleanup;
       }
       rcc->refresh_link
         = TALER_refresh_link_encrypted_decode (link_enc,
@@ -563,19 +539,11 @@ handle_refresh_melt_json (struct MHD_Connection *connection,
                                      TMH_PARSE_JNC_RET_DATA,
                                      &rcl->transfer_pub,
                                      sizeof (struct TALER_TransferPublicKeyP));
-
       if (GNUNET_OK != res)
       {
         GNUNET_break_op (0);
-        GNUNET_break (GNUNET_SYSERR != res);
-        GNUNET_CRYPTO_hash_context_abort (hash_context);
-        free_commit_coins (commit_coin,
-                           TALER_CNC_KAPPA,
-                           num_newcoins);
-        free_commit_links (commit_link,
-                           TALER_CNC_KAPPA,
-                           num_oldcoins);
-        return (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
+        res = (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
+        goto cleanup;
       }
       res = TMH_PARSE_navigate_json (connection,
                                      secret_encs,
@@ -584,30 +552,20 @@ handle_refresh_melt_json (struct MHD_Connection *connection,
                                      TMH_PARSE_JNC_RET_DATA,
                                      &rcl->shared_secret_enc,
                                      sizeof (struct TALER_EncryptedLinkSecretP));
-
       if (GNUNET_OK != res)
       {
         GNUNET_break_op (0);
-        GNUNET_break (GNUNET_SYSERR != res);
-        GNUNET_CRYPTO_hash_context_abort (hash_context);
-        free_commit_coins (commit_coin,
-                           TALER_CNC_KAPPA,
-                           num_newcoins);
-        free_commit_links (commit_link,
-                           TALER_CNC_KAPPA,
-                           num_oldcoins);
-        return (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
+        res = (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
+        goto cleanup;
       }
-
       GNUNET_CRYPTO_hash_context_read (hash_context,
                                        rcl,
                                        sizeof (struct TALER_RefreshCommitLinkP));
     }
-
   }
   GNUNET_CRYPTO_hash_context_finish (hash_context,
                                      &session_hash);
-
+  hash_context = NULL;
   for (i=0;i<coin_count;i++)
   {
     /* verify signatures on coins to melt */
@@ -638,15 +596,22 @@ handle_refresh_melt_json (struct MHD_Connection *connection,
   free_commit_links (commit_link,
                      TALER_CNC_KAPPA,
                      num_oldcoins);
+ cleanup_melt_details:
   for (j=0;j<coin_count;j++)
   {
-    GNUNET_CRYPTO_rsa_public_key_free (coin_melt_details[j].coin_info.denom_pub.rsa_public_key);
-    GNUNET_CRYPTO_rsa_signature_free (coin_melt_details[j].coin_info.denom_sig.rsa_signature);
+    if (NULL != coin_melt_details[j].coin_info.denom_pub.rsa_public_key)
+      GNUNET_CRYPTO_rsa_public_key_free (coin_melt_details[j].coin_info.denom_pub.rsa_public_key);
+    if (NULL != coin_melt_details[j].coin_info.denom_sig.rsa_signature)
+      GNUNET_CRYPTO_rsa_signature_free (coin_melt_details[j].coin_info.denom_sig.rsa_signature);
   }
-  for (j=0;j<num_new_denoms;j++)
-    GNUNET_CRYPTO_rsa_public_key_free (denom_pubs[j].rsa_public_key);
   GNUNET_free (coin_melt_details);
+ cleanup_denoms:
+  for (j=0;j<num_new_denoms;j++)
+    if (NULL != denom_pubs[j].rsa_public_key)
+      GNUNET_CRYPTO_rsa_public_key_free (denom_pubs[j].rsa_public_key);
   GNUNET_free (denom_pubs);
+  if (NULL != hash_context)
+    GNUNET_CRYPTO_hash_context_abort (hash_context);
   return res;
 }
 
@@ -736,6 +701,7 @@ TMH_REFRESH_handler_refresh_melt (struct TMH_RequestHandler *rh,
     return (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
   }
   num_newcoins = json_array_size (coin_detail);
+  json_decref (coin_detail);
   res = TMH_PARSE_navigate_json (connection,
                                  transfer_pubs,
                                  TMH_PARSE_JNC_INDEX, (int) 0,
@@ -748,7 +714,7 @@ TMH_REFRESH_handler_refresh_melt (struct TMH_RequestHandler *rh,
     return (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
   }
   num_oldcoins = json_array_size (coin_detail);
-
+  json_decref (coin_detail);
   res = handle_refresh_melt_json (connection,
                                   new_denoms,
                                   melt_coins,
@@ -758,7 +724,6 @@ TMH_REFRESH_handler_refresh_melt (struct TMH_RequestHandler *rh,
                                   num_newcoins,
                                   coin_evs,
                                   link_encs);
-
   TMH_PARSE_release_data (spec);
   return res;
 }
@@ -899,6 +864,7 @@ TMH_REFRESH_handler_refresh_reveal (struct TMH_RequestHandler *rh,
     return (GNUNET_SYSERR == res) ? MHD_NO : MHD_YES;
   }
   num_oldcoins = json_array_size (reveal_detail);
+  json_decref (reveal_detail);
   res = handle_refresh_reveal_json (connection,
                                     &session_hash,
                                     num_oldcoins,
-- 
cgit v1.2.3