From a52ccb2fe170558fc0aab4dd1d15ba8808b10951 Mon Sep 17 00:00:00 2001
From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
Date: Thu, 21 Dec 2017 20:36:48 +0100
Subject: shared/compat: fix memory handling of nm_setting_vpn_get_*_keys()

The previous fix was bad because the keys do not come from NMSettingVpn's hash
table but are copies that are freed by nm_setting_vpn_foreach_* before
it returns.

[thaller@redhat.com: import shared code from NetworkManager, merging
three patches together.]

Fixes: e93ca7fc129ec0f29f5313a3aa12839914df8fa2
Fixes: 0c90e08f77b71d2bda699cf032fceec0122bbf82

https://mail.gnome.org/archives/networkmanager-list/2017-December/msg00069.html
https://mail.gnome.org/archives/networkmanager-list/2017-December/msg00070.html
---
 shared/nm-utils/nm-compat.c | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/shared/nm-utils/nm-compat.c b/shared/nm-utils/nm-compat.c
index 47035e6..90328c0 100644
--- a/shared/nm-utils/nm-compat.c
+++ b/shared/nm-utils/nm-compat.c
@@ -30,7 +30,7 @@ _get_keys_cb (const char *key, const char *val, gpointer user_data)
 {
 	GPtrArray *a = user_data;
 
-	g_ptr_array_add (a, (gpointer) key);
+	g_ptr_array_add (a, g_strdup (key));
 }
 
 static const char **
@@ -40,22 +40,37 @@ _get_keys (NMSettingVpn *setting,
 {
 	guint len;
 	const char **keys = NULL;
-	gs_unref_ptrarray GPtrArray *a = NULL;
+	GPtrArray *a;
 
 	nm_assert (NM_IS_SETTING_VPN (setting));
 
-	a = g_ptr_array_new ();
+	if (is_secrets)
+		len = nm_setting_vpn_get_num_secrets (setting);
+	else
+		len = nm_setting_vpn_get_num_data_items (setting);
+
+	a = g_ptr_array_sized_new (len + 1);
+
 	if (is_secrets)
 		nm_setting_vpn_foreach_secret (setting, _get_keys_cb, a);
 	else
 		nm_setting_vpn_foreach_data_item (setting, _get_keys_cb, a);
-	len = a->len;
 
-	if (a->len) {
+	len = a->len;
+	if (len) {
 		g_ptr_array_sort (a, nm_strcmp_p);
 		g_ptr_array_add (a, NULL);
-		keys = (const char **) g_ptr_array_free (g_steal_pointer (&a), FALSE);
-	}
+		keys = g_memdup (a->pdata, a->len * sizeof (gpointer));
+
+		/* we need to cache the keys *somewhere*. */
+		g_object_set_qdata_full (G_OBJECT (setting),
+		                         is_secrets
+		                         ? NM_CACHED_QUARK ("libnm._nm_setting_vpn_get_secret_keys")
+		                         : NM_CACHED_QUARK ("libnm._nm_setting_vpn_get_data_keys"),
+		                         g_ptr_array_free (a, FALSE),
+		                         (GDestroyNotify) g_strfreev);
+	} else
+		g_ptr_array_free (a, TRUE);
 
 	NM_SET_OUT (out_length, len);
 	return keys;
-- 
cgit v0.12