From 7ca6ca4e96a93f9c23fc54320f5ff8e4ff044c8f Mon Sep 17 00:00:00 2001
From: Kazuki Yamaguchi <k@rhe.jp>
Date: Sun, 1 Oct 2017 15:02:54 +0900
Subject: gdbm, dbm, sdbm: prevent possible leak in #initialize

Allocate struct dbmdata before opening a file in case of out of memory.

As a bonus, make ext/dbm and ext/sdbm close the currently open file if
any, as ext/gdbm is doing.
---
 ext/dbm/dbm.c   | 12 ++++++------
 ext/gdbm/gdbm.c | 13 ++++++-------
 ext/sdbm/init.c | 12 ++++++------
 3 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/ext/dbm/dbm.c b/ext/dbm/dbm.c
index fec06a0dac..1f69f68a5a 100644
--- a/ext/dbm/dbm.c
+++ b/ext/dbm/dbm.c
@@ -47,7 +47,6 @@ closed_dbm(void)
 
 #define GetDBM(obj, dbmp) do {\
     TypedData_Get_Struct((obj), struct dbmdata, &dbm_type, (dbmp));\
-    if ((dbmp) == 0) closed_dbm();\
     if ((dbmp)->di_dbm == 0) closed_dbm();\
 } while (0)
 
@@ -115,8 +114,6 @@ fdbm_closed(VALUE obj)
     struct dbmdata *dbmp;
 
     TypedData_Get_Struct(obj, struct dbmdata, &dbm_type, dbmp);
-    if (dbmp == 0)
-	return Qtrue;
     if (dbmp->di_dbm == 0)
 	return Qtrue;
 
@@ -126,7 +123,9 @@ fdbm_closed(VALUE obj)
 static VALUE
 fdbm_alloc(VALUE klass)
 {
-    return TypedData_Wrap_Struct(klass, &dbm_type, 0);
+    struct dbmdata *dbmp;
+
+    return TypedData_Make_Struct(klass, struct dbmdata, &dbm_type, dbmp);
 }
 
 /*
@@ -150,6 +149,7 @@ fdbm_initialize(int argc, VALUE *argv, VALUE obj)
     struct dbmdata *dbmp;
     int mode, flags = 0;
 
+    TypedData_Get_Struct(obj, struct dbmdata, &dbm_type, dbmp);
     if (rb_scan_args(argc, argv, "12", &file, &vmode, &vflags) == 1) {
 	mode = 0666;		/* default value */
     }
@@ -228,8 +228,8 @@ fdbm_initialize(int argc, VALUE *argv, VALUE obj)
 	rb_sys_fail_str(file);
     }
 
-    dbmp = ALLOC(struct dbmdata);
-    DATA_PTR(obj) = dbmp;
+    if (dbmp->di_dbm)
+	dbm_close(dbmp->di_dbm);
     dbmp->di_dbm = dbm;
     dbmp->di_size = -1;
 
diff --git a/ext/gdbm/gdbm.c b/ext/gdbm/gdbm.c
index 5cd9f145d0..2aa9010c57 100644
--- a/ext/gdbm/gdbm.c
+++ b/ext/gdbm/gdbm.c
@@ -102,7 +102,6 @@ closed_dbm(void)
 
 #define GetDBM(obj, dbmp) do {\
     TypedData_Get_Struct((obj), struct dbmdata, &dbm_type, (dbmp));\
-    if ((dbmp) == 0) closed_dbm();\
     if ((dbmp)->di_dbm == 0) closed_dbm();\
 } while (0)
 
@@ -170,8 +169,6 @@ fgdbm_closed(VALUE obj)
     struct dbmdata *dbmp;
 
     TypedData_Get_Struct(obj, struct dbmdata, &dbm_type, dbmp);
-    if (dbmp == 0)
-        return Qtrue;
     if (dbmp->di_dbm == 0)
         return Qtrue;
 
@@ -181,7 +178,9 @@ fgdbm_closed(VALUE obj)
 static VALUE
 fgdbm_s_alloc(VALUE klass)
 {
-    return TypedData_Wrap_Struct(klass, &dbm_type, 0);
+    struct dbmdata *dbmp;
+
+    return TypedData_Make_Struct(klass, struct dbmdata, &dbm_type, dbmp);
 }
 
 /*
@@ -215,6 +214,7 @@ fgdbm_initialize(int argc, VALUE *argv, VALUE obj)
     struct dbmdata *dbmp;
     int mode, flags = 0;
 
+    TypedData_Get_Struct(obj, struct dbmdata, &dbm_type, dbmp);
     if (rb_scan_args(argc, argv, "12", &file, &vmode, &vflags) == 1) {
         mode = 0666;            /* default value */
     }
@@ -268,9 +268,8 @@ fgdbm_initialize(int argc, VALUE *argv, VALUE obj)
             rb_raise(rb_eGDBMError, "%s", gdbm_strerror(gdbm_errno));
     }
 
-    dbmp = ALLOC(struct dbmdata);
-    free_dbm(DATA_PTR(obj));
-    DATA_PTR(obj) = dbmp;
+    if (dbmp->di_dbm)
+	gdbm_close(dbmp->di_dbm);
     dbmp->di_dbm = dbm;
     dbmp->di_size = -1;
 
diff --git a/ext/sdbm/init.c b/ext/sdbm/init.c
index 684f31b98f..de99b07367 100644
--- a/ext/sdbm/init.c
+++ b/ext/sdbm/init.c
@@ -79,7 +79,6 @@ closed_sdbm(void)
 
 #define GetDBM(obj, dbmp) do {\
     TypedData_Get_Struct((obj), struct dbmdata, &sdbm_type, (dbmp));\
-    if ((dbmp) == 0) closed_sdbm();\
     if ((dbmp)->di_dbm == 0) closed_sdbm();\
 } while (0)
 
@@ -148,8 +147,6 @@ fsdbm_closed(VALUE obj)
     struct dbmdata *dbmp;
 
     TypedData_Get_Struct(obj, struct dbmdata, &sdbm_type, dbmp);
-    if (dbmp == 0)
-	return Qtrue;
     if (dbmp->di_dbm == 0)
 	return Qtrue;
 
@@ -159,7 +156,9 @@ fsdbm_closed(VALUE obj)
 static VALUE
 fsdbm_alloc(VALUE klass)
 {
-    return TypedData_Wrap_Struct(klass, &sdbm_type, 0);
+    struct dbmdata *dbmp;
+
+    return TypedData_Make_Struct(klass, struct dbmdata, &sdbm_type, dbmp);
 }
 /*
  * call-seq:
@@ -184,6 +183,7 @@ fsdbm_initialize(int argc, VALUE *argv, VALUE obj)
     struct dbmdata *dbmp;
     int mode;
 
+    TypedData_Get_Struct(obj, struct dbmdata, &sdbm_type, dbmp);
     if (rb_scan_args(argc, argv, "11", &file, &vmode) == 1) {
 	mode = 0666;		/* default value */
     }
@@ -208,8 +208,8 @@ fsdbm_initialize(int argc, VALUE *argv, VALUE obj)
 	rb_sys_fail_str(file);
     }
 
-    dbmp = ALLOC(struct dbmdata);
-    DATA_PTR(obj) = dbmp;
+    if (dbmp->di_dbm)
+	sdbm_close(dbmp->di_dbm);
     dbmp->di_dbm = dbm;
     dbmp->di_size = -1;
 
-- 
cgit v1.2.3