From 2d4110996bea53a9568b750d00d4dcdcc3907bc6 Mon Sep 17 00:00:00 2001
From: defanor <defanor@uberspace.net>
Date: Fri, 9 Jun 2023 14:43:15 +0300
Subject: Avoid direct strdup of values returned by rexmpp_xml_find_attr_val

Better to check those to not be NULL first.
---
 src/rexmpp.c        | 16 ++++++++++++----
 src/rexmpp_jingle.c |  4 ++--
 src/rexmpp_roster.c |  6 +++++-
 3 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/src/rexmpp.c b/src/rexmpp.c
index 80d7cc2..7eede3f 100644
--- a/src/rexmpp.c
+++ b/src/rexmpp.c
@@ -267,9 +267,9 @@ char *rexmpp_get_name (rexmpp_t *s, const char *jid_str) {
   if (s->manage_roster) {
     rexmpp_xml_t *roster_item = rexmpp_roster_find_item(s, jid.bare, NULL);
     if (roster_item != NULL) {
-      char *name = strdup(rexmpp_xml_find_attr_val(roster_item, "name"));
+      const char *name = rexmpp_xml_find_attr_val(roster_item, "name");
       if (name != NULL) {
-        return name;
+        return strdup(name);
       }
     }
     if (s->track_roster_events) {
@@ -1863,7 +1863,11 @@ rexmpp_err_t rexmpp_process_element (rexmpp_t *s, rexmpp_xml_t *elem) {
           if (s->roster_ver != NULL) {
             free(s->roster_ver);
           }
-          s->roster_ver = strdup(rexmpp_xml_find_attr_val(query, "ver"));
+          s->roster_ver = NULL;
+          const char *roster_ver = rexmpp_xml_find_attr_val(query, "ver");
+          if (roster_ver != NULL) {
+            s->roster_ver = strdup(roster_ver);
+          }
           rexmpp_modify_roster(s, rexmpp_xml_first_elem_child(query));
           /* todo: check for errors */
           rexmpp_iq_reply(s, elem, "result", NULL);
@@ -2147,7 +2151,11 @@ rexmpp_err_t rexmpp_process_element (rexmpp_t *s, rexmpp_xml_t *elem) {
         if (s->stream_id != NULL) {
           free(s->stream_id);
         }
-        s->stream_id = strdup(rexmpp_xml_find_attr_val(elem, "id"));
+        const char *stream_id = rexmpp_xml_find_attr_val(elem, "id");
+        s->stream_id = NULL;
+        if (stream_id != NULL) {
+          s->stream_id = strdup(stream_id);
+        }
       }
       rexmpp_stream_is_ready(s);
     } else if (rexmpp_xml_match(elem, "urn:xmpp:sm:3", "failed")) {
diff --git a/src/rexmpp_jingle.c b/src/rexmpp_jingle.c
index 573c193..11393c0 100644
--- a/src/rexmpp_jingle.c
+++ b/src/rexmpp_jingle.c
@@ -1511,7 +1511,7 @@ int rexmpp_jingle_iq (rexmpp_t *s, rexmpp_xml_t *elem) {
                                   "description");
 
           if (file_description != NULL && ibb_transport != NULL) {
-            char *ibb_sid = strdup(rexmpp_xml_find_attr_val(ibb_transport, "sid"));
+            const char *ibb_sid = rexmpp_xml_find_attr_val(ibb_transport, "sid");
             if (ibb_sid != NULL) {
               rexmpp_log(s, LOG_DEBUG,
                          "Jingle session-initiate from %s, sid %s, ibb sid %s",
@@ -1521,7 +1521,7 @@ int rexmpp_jingle_iq (rexmpp_t *s, rexmpp_xml_t *elem) {
                                              REXMPP_JINGLE_SESSION_FILE, 0);
               if (sess != NULL) {
                 sess->initiate = rexmpp_xml_clone(jingle);
-                sess->ibb_sid = ibb_sid;
+                sess->ibb_sid = strdup(ibb_sid);
               } else {
                 rexmpp_jingle_session_terminate(s, sid,
                                                 rexmpp_xml_new_elem("failed-transport",
diff --git a/src/rexmpp_roster.c b/src/rexmpp_roster.c
index db09ff0..6bc05fc 100644
--- a/src/rexmpp_roster.c
+++ b/src/rexmpp_roster.c
@@ -91,7 +91,11 @@ void rexmpp_roster_set (rexmpp_t *s, rexmpp_xml_t *query) {
   if (s->roster_ver != NULL) {
     free(s->roster_ver);
   }
-  s->roster_ver = strdup(rexmpp_xml_find_attr_val(query, "ver"));
+  const char *roster_ver = rexmpp_xml_find_attr_val(query, "ver");
+  s->roster_ver = NULL;
+  if (roster_ver != NULL) {
+    s->roster_ver = strdup(roster_ver);
+  }
   s->roster_items = rexmpp_xml_clone_list(query->alt.elem.children);
   if (s->roster_modify_cb != NULL) {
     rexmpp_xml_t *item;
-- 
cgit v1.2.3