strip: Fix invalid parsing

strip() memmove count was one short, dropping the NULL  terminator;
dpado_parse error path leaked already-parsed range entries.
Also affects ipoe.

Since strip is identical in both, we can place fixed common function in utils.

Reported-by: Khedor <khedor@gmail.com>
Signed-off-by: Denys Fedoryshchenko <denys.f@collabora.com>

2 files changed, 31 insertions, 34 deletions

diff --git a/accel-pppd/ctrl/ipoe/ipoe.c b/accel-pppd/ctrl/ipoe/ipoe.c
index 5592845f..4bf43434 100644
--- a/accel-pppd/ctrl/ipoe/ipoe.c
+++ b/accel-pppd/ctrl/ipoe/ipoe.c
@@ -3574,19 +3574,6 @@ static void load_radius_attrs(void)
 }
 #endif
 
-static void strip(char *str)
-{
-	char *ptr = str;
-	char *endptr = strchr(str, 0);
-	while (1) {
-		ptr = strchr(ptr, ' ');
-		if (ptr)
-			memmove(ptr, ptr + 1, endptr - ptr - 1);
-		else
-			break;
-	}
-}
-
 int parse_offer_delay(const char *str)
 {
 	char *str1;
@@ -3603,7 +3590,7 @@ int parse_offer_delay(const char *str)
 		return 0;
 
 	str1 = _strdup(str);
-	strip(str1);
+	u_strstrip(str1, ' ');
 
 	ptr1 = str1;
 
@@ -3619,17 +3606,23 @@ int parse_offer_delay(const char *str)
 		memset(r, 0, sizeof(*r));
 
 		r->delay = strtol(ptr1, &endptr, 10);
-		if (*endptr)
+		if (*endptr) {
+			_free(r);
 			goto out_err;
+		}
 
 		if (list_empty(&conf_offer_delay))
 			r->conn_cnt = 0;
 		else {
-			if (!ptr3)
+			if (!ptr3) {
+				_free(r);
 				goto out_err;
+			}
 			r->conn_cnt = strtol(ptr3 + 1, &endptr, 10);
-			if (*endptr)
+			if (*endptr) {
+				_free(r);
 				goto out_err;
+			}
 		}
 
 		list_add_tail(&r->entry, &conf_offer_delay);
@@ -3644,6 +3637,11 @@ int parse_offer_delay(const char *str)
 	return 0;
 
 out_err:
+	while (!list_empty(&conf_offer_delay)) {
+		r = list_entry(conf_offer_delay.next, typeof(*r), entry);
+		list_del(&r->entry);
+		_free(r);
+	}
 	_free(str1);
 	log_error("ipoe: failed to parse offer-delay\n");
 	return -1;
diff --git a/accel-pppd/ctrl/pppoe/dpado.c b/accel-pppd/ctrl/pppoe/dpado.c
index 351a43dc..dc570dda 100644
--- a/accel-pppd/ctrl/pppoe/dpado.c
+++ b/accel-pppd/ctrl/pppoe/dpado.c
@@ -11,6 +11,7 @@
 #include "triton.h"
 #include "log.h"
 #include "memdebug.h"
+#include "utils.h"
 
 #include "pppoe.h"
 
@@ -60,19 +61,6 @@ void dpado_check_prev(int conn_cnt)
 	pthread_mutex_unlock(&dpado_range_lock);
 }
 
-static void strip(char *str)
-{
-	char *ptr = str;
-	char *endptr = strchr(str, 0);
-	while (1) {
-		ptr = strchr(ptr, ' ');
-		if (ptr)
-			memmove(ptr, ptr + 1, endptr - ptr - 1);
-		else
-			break;
-	}
-}
-
 int dpado_parse(const char *str)
 {
 	char *str1 = _strdup(str);
@@ -81,7 +69,7 @@ int dpado_parse(const char *str)
 	LIST_HEAD(range_list);
 	struct dpado_range_t *r;
 
-	strip(str1);
+	u_strstrip(str1, ' ');
 
 	ptr1 = str1;
 
@@ -97,17 +85,23 @@ int dpado_parse(const char *str)
 		memset(r, 0, sizeof(*r));
 
 		r->pado_delay = strtol(ptr1, &endptr, 10);
-		if (*endptr)
+		if (*endptr) {
+			_free(r);
 			goto out_err;
+		}
 
 		if (list_empty(&range_list))
 			r->conn_cnt = INT_MAX;
 		else {
-			if (!ptr3)
+			if (!ptr3) {
+				_free(r);
 				goto out_err;
+			}
 			r->conn_cnt = strtol(ptr3 + 1, &endptr, 10);
-			if (*endptr)
+			if (*endptr) {
+				_free(r);
 				goto out_err;
+			}
 		}
 
 		list_add_tail(&r->entry, &range_list);
@@ -160,6 +154,11 @@ int dpado_parse(const char *str)
 	return 0;
 
 out_err:
+	while (!list_empty(&range_list)) {
+		r = list_entry(range_list.next, typeof(*r), entry);
+		list_del(&r->entry);
+		_free(r);
+	}
 	_free(str1);
 	log_emerg("pppoe: pado_delay: invalid format\n");
 	return -1;