fix: events leak that can occur if allocation fails

rare in practice, found by fuzzing
TokTok · Oct 9, 2024 · 1fabce5 · 1fabce5
1 parent 03e9fbf
commit 1fabce5
Show file tree

Hide file tree

Showing 40 changed files with 160 additions and 40 deletions.
diff --git a/other/event_tooling/generate_event_c.cpp b/other/event_tooling/generate_event_c.cpp
@@ -444,7 +444,10 @@ void generate_event_impl(const std::string& event_name, const std::vector<EventT
     f << "    Tox_Event event;\n";
     f << "    event.type = TOX_EVENT_" << str_toupper(event_name) << ";\n";
     f << "    event.data." << event_name_l << " = " << event_name_l << ";\n\n";
-    f << "    tox_events_add(events, &event);\n";
+    f << "    if (!tox_events_add(events, &event)) {\n";
+    f << "        tox_event_" << event_name_l << "_free(" << event_name_l << ", mem);\n";
+    f << "        return nullptr;\n";
+    f << "    }\n";
     f << "    return " << event_name_l << ";\n}\n\n";
 
     // unpack

diff --git a/toxcore/events/conference_connected.c b/toxcore/events/conference_connected.c
@@ -109,7 +109,10 @@ static Tox_Event_Conference_Connected *tox_events_add_conference_connected(Tox_E
     event.type = TOX_EVENT_CONFERENCE_CONNECTED;
     event.data.conference_connected = conference_connected;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_conference_connected_free(conference_connected, mem);
+        return nullptr;
+    }
     return conference_connected;
 }
 

diff --git a/toxcore/events/conference_invite.c b/toxcore/events/conference_invite.c
@@ -177,7 +177,10 @@ static Tox_Event_Conference_Invite *tox_events_add_conference_invite(Tox_Events
     event.type = TOX_EVENT_CONFERENCE_INVITE;
     event.data.conference_invite = conference_invite;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_conference_invite_free(conference_invite, mem);
+        return nullptr;
+    }
     return conference_invite;
 }
 

diff --git a/toxcore/events/conference_message.c b/toxcore/events/conference_message.c
@@ -193,7 +193,10 @@ static Tox_Event_Conference_Message *tox_events_add_conference_message(Tox_Event
     event.type = TOX_EVENT_CONFERENCE_MESSAGE;
     event.data.conference_message = conference_message;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_conference_message_free(conference_message, mem);
+        return nullptr;
+    }
     return conference_message;
 }
 

diff --git a/toxcore/events/conference_peer_list_changed.c b/toxcore/events/conference_peer_list_changed.c
@@ -109,7 +109,10 @@ static Tox_Event_Conference_Peer_List_Changed *tox_events_add_conference_peer_li
     event.type = TOX_EVENT_CONFERENCE_PEER_LIST_CHANGED;
     event.data.conference_peer_list_changed = conference_peer_list_changed;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_conference_peer_list_changed_free(conference_peer_list_changed, mem);
+        return nullptr;
+    }
     return conference_peer_list_changed;
 }
 

diff --git a/toxcore/events/conference_peer_name.c b/toxcore/events/conference_peer_name.c
@@ -175,7 +175,10 @@ static Tox_Event_Conference_Peer_Name *tox_events_add_conference_peer_name(Tox_E
     event.type = TOX_EVENT_CONFERENCE_PEER_NAME;
     event.data.conference_peer_name = conference_peer_name;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_conference_peer_name_free(conference_peer_name, mem);
+        return nullptr;
+    }
     return conference_peer_name;
 }
 

diff --git a/toxcore/events/conference_title.c b/toxcore/events/conference_title.c
@@ -175,7 +175,10 @@ static Tox_Event_Conference_Title *tox_events_add_conference_title(Tox_Events *e
     event.type = TOX_EVENT_CONFERENCE_TITLE;
     event.data.conference_title = conference_title;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_conference_title_free(conference_title, mem);
+        return nullptr;
+    }
     return conference_title;
 }
 

diff --git a/toxcore/events/file_chunk_request.c b/toxcore/events/file_chunk_request.c
@@ -162,7 +162,10 @@ static Tox_Event_File_Chunk_Request *tox_events_add_file_chunk_request(Tox_Event
     event.type = TOX_EVENT_FILE_CHUNK_REQUEST;
     event.data.file_chunk_request = file_chunk_request;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_file_chunk_request_free(file_chunk_request, mem);
+        return nullptr;
+    }
     return file_chunk_request;
 }
 

diff --git a/toxcore/events/file_recv.c b/toxcore/events/file_recv.c
@@ -207,7 +207,10 @@ static Tox_Event_File_Recv *tox_events_add_file_recv(Tox_Events *events, const M
     event.type = TOX_EVENT_FILE_RECV;
     event.data.file_recv = file_recv;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_file_recv_free(file_recv, mem);
+        return nullptr;
+    }
     return file_recv;
 }
 

diff --git a/toxcore/events/file_recv_chunk.c b/toxcore/events/file_recv_chunk.c
@@ -191,7 +191,10 @@ static Tox_Event_File_Recv_Chunk *tox_events_add_file_recv_chunk(Tox_Events *eve
     event.type = TOX_EVENT_FILE_RECV_CHUNK;
     event.data.file_recv_chunk = file_recv_chunk;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_file_recv_chunk_free(file_recv_chunk, mem);
+        return nullptr;
+    }
     return file_recv_chunk;
 }
 

diff --git a/toxcore/events/file_recv_control.c b/toxcore/events/file_recv_control.c
@@ -148,7 +148,10 @@ static Tox_Event_File_Recv_Control *tox_events_add_file_recv_control(Tox_Events
     event.type = TOX_EVENT_FILE_RECV_CONTROL;
     event.data.file_recv_control = file_recv_control;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_file_recv_control_free(file_recv_control, mem);
+        return nullptr;
+    }
     return file_recv_control;
 }
 

diff --git a/toxcore/events/friend_connection_status.c b/toxcore/events/friend_connection_status.c
@@ -132,7 +132,10 @@ static Tox_Event_Friend_Connection_Status *tox_events_add_friend_connection_stat
     event.type = TOX_EVENT_FRIEND_CONNECTION_STATUS;
     event.data.friend_connection_status = friend_connection_status;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_friend_connection_status_free(friend_connection_status, mem);
+        return nullptr;
+    }
     return friend_connection_status;
 }
 

diff --git a/toxcore/events/friend_lossless_packet.c b/toxcore/events/friend_lossless_packet.c
@@ -159,7 +159,10 @@ static Tox_Event_Friend_Lossless_Packet *tox_events_add_friend_lossless_packet(T
     event.type = TOX_EVENT_FRIEND_LOSSLESS_PACKET;
     event.data.friend_lossless_packet = friend_lossless_packet;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_friend_lossless_packet_free(friend_lossless_packet, mem);
+        return nullptr;
+    }
     return friend_lossless_packet;
 }
 

diff --git a/toxcore/events/friend_lossy_packet.c b/toxcore/events/friend_lossy_packet.c
@@ -159,7 +159,10 @@ static Tox_Event_Friend_Lossy_Packet *tox_events_add_friend_lossy_packet(Tox_Eve
     event.type = TOX_EVENT_FRIEND_LOSSY_PACKET;
     event.data.friend_lossy_packet = friend_lossy_packet;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_friend_lossy_packet_free(friend_lossy_packet, mem);
+        return nullptr;
+    }
     return friend_lossy_packet;
 }
 

diff --git a/toxcore/events/friend_message.c b/toxcore/events/friend_message.c
@@ -177,7 +177,10 @@ static Tox_Event_Friend_Message *tox_events_add_friend_message(Tox_Events *event
     event.type = TOX_EVENT_FRIEND_MESSAGE;
     event.data.friend_message = friend_message;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_friend_message_free(friend_message, mem);
+        return nullptr;
+    }
     return friend_message;
 }
 

diff --git a/toxcore/events/friend_name.c b/toxcore/events/friend_name.c
@@ -159,7 +159,10 @@ static Tox_Event_Friend_Name *tox_events_add_friend_name(Tox_Events *events, con
     event.type = TOX_EVENT_FRIEND_NAME;
     event.data.friend_name = friend_name;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_friend_name_free(friend_name, mem);
+        return nullptr;
+    }
     return friend_name;
 }
 

diff --git a/toxcore/events/friend_read_receipt.c b/toxcore/events/friend_read_receipt.c
@@ -130,7 +130,10 @@ static Tox_Event_Friend_Read_Receipt *tox_events_add_friend_read_receipt(Tox_Eve
     event.type = TOX_EVENT_FRIEND_READ_RECEIPT;
     event.data.friend_read_receipt = friend_read_receipt;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_friend_read_receipt_free(friend_read_receipt, mem);
+        return nullptr;
+    }
     return friend_read_receipt;
 }
 

diff --git a/toxcore/events/friend_request.c b/toxcore/events/friend_request.c
@@ -152,7 +152,10 @@ static Tox_Event_Friend_Request *tox_events_add_friend_request(Tox_Events *event
     event.type = TOX_EVENT_FRIEND_REQUEST;
     event.data.friend_request = friend_request;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_friend_request_free(friend_request, mem);
+        return nullptr;
+    }
     return friend_request;
 }
 

diff --git a/toxcore/events/friend_status.c b/toxcore/events/friend_status.c
@@ -132,7 +132,10 @@ static Tox_Event_Friend_Status *tox_events_add_friend_status(Tox_Events *events,
     event.type = TOX_EVENT_FRIEND_STATUS;
     event.data.friend_status = friend_status;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_friend_status_free(friend_status, mem);
+        return nullptr;
+    }
     return friend_status;
 }
 

diff --git a/toxcore/events/friend_status_message.c b/toxcore/events/friend_status_message.c
@@ -159,7 +159,10 @@ static Tox_Event_Friend_Status_Message *tox_events_add_friend_status_message(Tox
     event.type = TOX_EVENT_FRIEND_STATUS_MESSAGE;
     event.data.friend_status_message = friend_status_message;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_friend_status_message_free(friend_status_message, mem);
+        return nullptr;
+    }
     return friend_status_message;
 }
 

diff --git a/toxcore/events/friend_typing.c b/toxcore/events/friend_typing.c
@@ -130,7 +130,10 @@ static Tox_Event_Friend_Typing *tox_events_add_friend_typing(Tox_Events *events,
     event.type = TOX_EVENT_FRIEND_TYPING;
     event.data.friend_typing = friend_typing;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_friend_typing_free(friend_typing, mem);
+        return nullptr;
+    }
     return friend_typing;
 }
 

diff --git a/toxcore/events/group_custom_packet.c b/toxcore/events/group_custom_packet.c
@@ -175,7 +175,10 @@ static Tox_Event_Group_Custom_Packet *tox_events_add_group_custom_packet(Tox_Eve
     event.type = TOX_EVENT_GROUP_CUSTOM_PACKET;
     event.data.group_custom_packet = group_custom_packet;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_custom_packet_free(group_custom_packet, mem);
+        return nullptr;
+    }
     return group_custom_packet;
 }
 

diff --git a/toxcore/events/group_custom_private_packet.c b/toxcore/events/group_custom_private_packet.c
@@ -175,7 +175,10 @@ static Tox_Event_Group_Custom_Private_Packet *tox_events_add_group_custom_privat
     event.type = TOX_EVENT_GROUP_CUSTOM_PRIVATE_PACKET;
     event.data.group_custom_private_packet = group_custom_private_packet;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_custom_private_packet_free(group_custom_private_packet, mem);
+        return nullptr;
+    }
     return group_custom_private_packet;
 }
 

diff --git a/toxcore/events/group_invite.c b/toxcore/events/group_invite.c
@@ -203,7 +203,10 @@ static Tox_Event_Group_Invite *tox_events_add_group_invite(Tox_Events *events, c
     event.type = TOX_EVENT_GROUP_INVITE;
     event.data.group_invite = group_invite;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_invite_free(group_invite, mem);
+        return nullptr;
+    }
     return group_invite;
 }
 

diff --git a/toxcore/events/group_join_fail.c b/toxcore/events/group_join_fail.c
@@ -132,7 +132,10 @@ static Tox_Event_Group_Join_Fail *tox_events_add_group_join_fail(Tox_Events *eve
     event.type = TOX_EVENT_GROUP_JOIN_FAIL;
     event.data.group_join_fail = group_join_fail;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_join_fail_free(group_join_fail, mem);
+        return nullptr;
+    }
     return group_join_fail;
 }
 

diff --git a/toxcore/events/group_message.c b/toxcore/events/group_message.c
@@ -209,7 +209,10 @@ static Tox_Event_Group_Message *tox_events_add_group_message(Tox_Events *events,
     event.type = TOX_EVENT_GROUP_MESSAGE;
     event.data.group_message = group_message;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_message_free(group_message, mem);
+        return nullptr;
+    }
     return group_message;
 }
 

diff --git a/toxcore/events/group_moderation.c b/toxcore/events/group_moderation.c
@@ -164,7 +164,10 @@ static Tox_Event_Group_Moderation *tox_events_add_group_moderation(Tox_Events *e
     event.type = TOX_EVENT_GROUP_MODERATION;
     event.data.group_moderation = group_moderation;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_moderation_free(group_moderation, mem);
+        return nullptr;
+    }
     return group_moderation;
 }
 

diff --git a/toxcore/events/group_password.c b/toxcore/events/group_password.c
@@ -159,7 +159,10 @@ static Tox_Event_Group_Password *tox_events_add_group_password(Tox_Events *event
     event.type = TOX_EVENT_GROUP_PASSWORD;
     event.data.group_password = group_password;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_password_free(group_password, mem);
+        return nullptr;
+    }
     return group_password;
 }
 

diff --git a/toxcore/events/group_peer_exit.c b/toxcore/events/group_peer_exit.c
@@ -237,7 +237,10 @@ static Tox_Event_Group_Peer_Exit *tox_events_add_group_peer_exit(Tox_Events *eve
     event.type = TOX_EVENT_GROUP_PEER_EXIT;
     event.data.group_peer_exit = group_peer_exit;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_peer_exit_free(group_peer_exit, mem);
+        return nullptr;
+    }
     return group_peer_exit;
 }
 

diff --git a/toxcore/events/group_peer_join.c b/toxcore/events/group_peer_join.c
@@ -130,7 +130,10 @@ static Tox_Event_Group_Peer_Join *tox_events_add_group_peer_join(Tox_Events *eve
     event.type = TOX_EVENT_GROUP_PEER_JOIN;
     event.data.group_peer_join = group_peer_join;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_peer_join_free(group_peer_join, mem);
+        return nullptr;
+    }
     return group_peer_join;
 }
 

diff --git a/toxcore/events/group_peer_limit.c b/toxcore/events/group_peer_limit.c
@@ -130,7 +130,10 @@ static Tox_Event_Group_Peer_Limit *tox_events_add_group_peer_limit(Tox_Events *e
     event.type = TOX_EVENT_GROUP_PEER_LIMIT;
     event.data.group_peer_limit = group_peer_limit;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_peer_limit_free(group_peer_limit, mem);
+        return nullptr;
+    }
     return group_peer_limit;
 }
 

diff --git a/toxcore/events/group_peer_name.c b/toxcore/events/group_peer_name.c
@@ -175,7 +175,10 @@ static Tox_Event_Group_Peer_Name *tox_events_add_group_peer_name(Tox_Events *eve
     event.type = TOX_EVENT_GROUP_PEER_NAME;
     event.data.group_peer_name = group_peer_name;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_peer_name_free(group_peer_name, mem);
+        return nullptr;
+    }
     return group_peer_name;
 }
 

diff --git a/toxcore/events/group_peer_status.c b/toxcore/events/group_peer_status.c
@@ -148,7 +148,10 @@ static Tox_Event_Group_Peer_Status *tox_events_add_group_peer_status(Tox_Events
     event.type = TOX_EVENT_GROUP_PEER_STATUS;
     event.data.group_peer_status = group_peer_status;
 
-    tox_events_add(events, &event);
+    if (!tox_events_add(events, &event)) {
+        tox_event_group_peer_status_free(group_peer_status, mem);
+        return nullptr;
+    }
     return group_peer_status;
 }