Buffer: free QJS buffers on conversion failures

qjs_buffer_from_string() and qjs_buffer_create() leaked the newly
allocated buffer when qjs_typed_array_data() or string decoding failed.

Also check the JS_ToCStringLen() result in qjs_buffer_from_string(), so
an allocation failure is not followed by a NULL pointer dereference.

diff --git a/src/qjs_buffer.c b/src/qjs_buffer.c
index 65c572164ab6fda16c0553fcc3c287ceee5a7616..2eb12e3ae755ac83ab93d6b88bf54b3d4431cd84 100644 (file)
--- a/src/qjs_buffer.c
+++ b/src/qjs_buffer.c
@@ -1890,6 +1890,9 @@ qjs_buffer_from_string(JSContext *ctx, JSValueConst str,
     }
 
     src.start = (u_char *) JS_ToCStringLen(ctx, &src.length, str);
+    if (src.start == NULL) {
+        return JS_EXCEPTION;
+    }
 
     if (encoding->decode_length != NULL) {
         size = encoding->decode_length(ctx, &src);
@@ -1907,12 +1910,14 @@ qjs_buffer_from_string(JSContext *ctx, JSValueConst str,
     ret = qjs_typed_array_data(ctx, buffer, &dst);
     if (JS_IsException(ret)) {
         JS_FreeCString(ctx, (char *) src.start);
+        JS_FreeValue(ctx, buffer);
         return ret;
     }
 
     if (encoding->decode != NULL) {
         if (encoding->decode(ctx, &src, &dst) != 0) {
             JS_FreeCString(ctx, (char *) src.start);
+            JS_FreeValue(ctx, buffer);
             JS_ThrowTypeError(ctx, "failed to decode string");
             return JS_EXCEPTION;
         }
@@ -2613,6 +2618,7 @@ qjs_buffer_create(JSContext *ctx, u_char *start, size_t size)
 
     ret = qjs_typed_array_data(ctx, buffer, &dst);
     if (JS_IsException(ret)) {
+        JS_FreeValue(ctx, buffer);
         return ret;
     }