ipc-server: fix more use-after-frees on ipc_send_reply error

Since ipc_send_reply frees the client on error, we need to check the
return value properly as we access client later on

Found through static analysis.

1 files changed, 31 insertions, 15 deletions

diff --git a/sway/ipc-server.c b/sway/ipc-server.c
index 2dfe2d03..3e510c2e 100644
--- a/sway/ipc-server.c
+++ b/sway/ipc-server.c
@@ -466,6 +466,7 @@ void ipc_client_handle_command(struct ipc_client *client) {
 	}
 	buf[client->payload_length] = '\0';
 
+	bool client_valid = true;
 	switch (client->current_command) {
 	case IPC_COMMAND:
 	{
@@ -473,7 +474,7 @@ void ipc_client_handle_command(struct ipc_client *client) {
 		const char *json = cmd_results_to_json(results);
 		char reply[256];
 		int length = snprintf(reply, sizeof(reply), "%s", json);
-		ipc_send_reply(client, reply, (uint32_t) length);
+		client_valid = ipc_send_reply(client, reply, (uint32_t)length);
 		free_cmd_results(results);
 		goto exit_cleanup;
 	}
@@ -496,7 +497,8 @@ void ipc_client_handle_command(struct ipc_client *client) {
 			}
 		}
 		const char *json_string = json_object_to_json_string(outputs);
-		ipc_send_reply(client, json_string, (uint32_t) strlen(json_string));
+		client_valid =
+			ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
 		json_object_put(outputs); // free
 		goto exit_cleanup;
 	}
@@ -507,7 +509,8 @@ void ipc_client_handle_command(struct ipc_client *client) {
 		container_for_each_descendant_dfs(&root_container,
 				ipc_get_workspaces_callback, workspaces);
 		const char *json_string = json_object_to_json_string(workspaces);
-		ipc_send_reply(client, json_string, (uint32_t) strlen(json_string));
+		client_valid =
+			ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
 		json_object_put(workspaces); // free
 		goto exit_cleanup;
 	}
@@ -517,7 +520,7 @@ void ipc_client_handle_command(struct ipc_client *client) {
 		// TODO: Check if they're permitted to use these events
 		struct json_object *request = json_tokener_parse(buf);
 		if (request == NULL) {
-			ipc_send_reply(client, "{\"success\": false}", 18);
+			client_valid = ipc_send_reply(client, "{\"success\": false}", 18);
 			wlr_log_errno(L_INFO, "Failed to read request");
 			goto exit_cleanup;
 		}
@@ -538,7 +541,8 @@ void ipc_client_handle_command(struct ipc_client *client) {
 			} else if (strcmp(event_type, "binding") == 0) {
 				client->subscribed_events |= event_mask(IPC_EVENT_BINDING);
 			} else {
-				ipc_send_reply(client, "{\"success\": false}", 18);
+				client_valid =
+					ipc_send_reply(client, "{\"success\": false}", 18);
 				json_object_put(request);
 				wlr_log_errno(L_INFO, "Failed to parse request");
 				goto exit_cleanup;
@@ -546,7 +550,7 @@ void ipc_client_handle_command(struct ipc_client *client) {
 		}
 
 		json_object_put(request);
-		ipc_send_reply(client, "{\"success\": true}", 17);
+		client_valid = ipc_send_reply(client, "{\"success\": true}", 17);
 		goto exit_cleanup;
 	}
 
@@ -558,7 +562,8 @@ void ipc_client_handle_command(struct ipc_client *client) {
 			json_object_array_add(inputs, ipc_json_describe_input(device));
 		}
 		const char *json_string = json_object_to_json_string(inputs);
-		ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
+		client_valid =
+			ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
 		json_object_put(inputs); // free
 		goto exit_cleanup;
 	}
@@ -571,7 +576,8 @@ void ipc_client_handle_command(struct ipc_client *client) {
 			json_object_array_add(seats, ipc_json_describe_seat(seat));
 		}
 		const char *json_string = json_object_to_json_string(seats);
-		ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
+		client_valid =
+			ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
 		json_object_put(seats); // free
 		goto exit_cleanup;
 	}
@@ -581,7 +587,8 @@ void ipc_client_handle_command(struct ipc_client *client) {
 		json_object *tree =
 			ipc_json_describe_container_recursive(&root_container);
 		const char *json_string = json_object_to_json_string(tree);
-		ipc_send_reply(client, json_string, (uint32_t) strlen(json_string));
+		client_valid =
+			ipc_send_reply(client, json_string, (uint32_t) strlen(json_string));
 		json_object_put(tree);
 		goto exit_cleanup;
 	}
@@ -592,7 +599,8 @@ void ipc_client_handle_command(struct ipc_client *client) {
 		container_descendants(&root_container, C_VIEW, ipc_get_marks_callback,
 				marks);
 		const char *json_string = json_object_to_json_string(marks);
-		ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
+		client_valid =
+			ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
 		json_object_put(marks);
 		goto exit_cleanup;
 	}
@@ -601,7 +609,8 @@ void ipc_client_handle_command(struct ipc_client *client) {
 	{
 		json_object *version = ipc_json_get_version();
 		const char *json_string = json_object_to_json_string(version);
-		ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
+		client_valid =
+			ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
 		json_object_put(version); // free
 		goto exit_cleanup;
 	}
@@ -616,7 +625,9 @@ void ipc_client_handle_command(struct ipc_client *client) {
 				json_object_array_add(bars, json_object_new_string(bar->id));
 			}
 			const char *json_string = json_object_to_json_string(bars);
-			ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
+			client_valid =
+				ipc_send_reply(client, json_string,
+					(uint32_t)strlen(json_string));
 			json_object_put(bars); // free
 		} else {
 			// Send particular bar's details
@@ -630,12 +641,15 @@ void ipc_client_handle_command(struct ipc_client *client) {
 			}
 			if (!bar) {
 				const char *error = "{ \"success\": false, \"error\": \"No bar with that ID\" }";
-				ipc_send_reply(client, error, (uint32_t)strlen(error));
+				client_valid =
+					ipc_send_reply(client, error, (uint32_t)strlen(error));
 				goto exit_cleanup;
 			}
 			json_object *json = ipc_json_describe_bar_config(bar);
 			const char *json_string = json_object_to_json_string(json);
-			ipc_send_reply(client, json_string, (uint32_t)strlen(json_string));
+			client_valid =
+				ipc_send_reply(client, json_string,
+					(uint32_t)strlen(json_string));
 			json_object_put(json); // free
 		}
 		goto exit_cleanup;
@@ -647,7 +661,9 @@ void ipc_client_handle_command(struct ipc_client *client) {
 	}
 
 exit_cleanup:
-	client->payload_length = 0;
+	if (client_valid) {
+		client->payload_length = 0;
+	}
 	free(buf);
 	return;
 }