Upstream-Status: Inappropriate [not used]

--- dbus_dict_helpers.c.array-fix	2006-12-18 12:31:11.000000000 -0500
+++ dbus_dict_helpers.c	2006-12-20 03:17:08.000000000 -0500
@@ -629,36 +629,55 @@ dbus_bool_t wpa_dbus_dict_open_read(DBus
 }
 
 
+#define BYTE_ARRAY_CHUNK_SIZE 34
+#define BYTE_ARRAY_ITEM_SIZE (sizeof (char))
+
 static dbus_bool_t _wpa_dbus_dict_entry_get_byte_array(
-	DBusMessageIter *iter, int array_len, int array_type,
+	DBusMessageIter *iter, int array_type,
 	struct wpa_dbus_dict_entry *entry)
 {
-	dbus_uint32_t i = 0;
+	dbus_uint32_t count = 0;
 	dbus_bool_t success = FALSE;
-	char byte;
+	char * buffer;
 
-	/* Zero-length arrays are valid. */
-	if (array_len == 0) {
-		entry->bytearray_value = NULL;
-		entry->array_type = DBUS_TYPE_BYTE;
-		success = TRUE;
-		goto done;
-	}
+	entry->bytearray_value = NULL;
+	entry->array_type = DBUS_TYPE_BYTE;
 
-	entry->bytearray_value = wpa_zalloc(array_len * sizeof(char));
-	if (!entry->bytearray_value) {
+	buffer = wpa_zalloc(BYTE_ARRAY_ITEM_SIZE * BYTE_ARRAY_CHUNK_SIZE);
+	if (!buffer) {
 		perror("_wpa_dbus_dict_entry_get_byte_array[dbus]: out of "
 		       "memory");
 		goto done;
 	}
 
-	entry->array_type = DBUS_TYPE_BYTE;
-	entry->array_len = array_len;
+	entry->bytearray_value = buffer;
+	entry->array_len = 0;
 	while (dbus_message_iter_get_arg_type(iter) == DBUS_TYPE_BYTE) {
+		char byte;
+
+		if ((count % BYTE_ARRAY_CHUNK_SIZE) == 0 && count != 0) {
+			buffer = realloc(buffer, BYTE_ARRAY_ITEM_SIZE * (count + BYTE_ARRAY_CHUNK_SIZE));
+			if (buffer == NULL) {
+				perror("_wpa_dbus_dict_entry_get_byte_array["
+				       "dbus] out of memory trying to "
+				       "retrieve the string array");
+				goto done;
+			}
+		}
+		entry->bytearray_value = buffer;
+
 		dbus_message_iter_get_basic(iter, &byte);
-		entry->bytearray_value[i++] = byte;
+		entry->bytearray_value[count] = byte;
+		entry->array_len = ++count;
 		dbus_message_iter_next(iter);
 	}
+
+	/* Zero-length arrays are valid. */
+	if (entry->array_len == 0) {
+		free(entry->bytearray_value);
+		entry->strarray_value = NULL;
+	}
+
 	success = TRUE;
 
 done:
@@ -666,8 +685,11 @@ done:
 }
 
 
+#define STR_ARRAY_CHUNK_SIZE 8
+#define STR_ARRAY_ITEM_SIZE (sizeof (char *))
+
 static dbus_bool_t _wpa_dbus_dict_entry_get_string_array(
-	DBusMessageIter *iter, int array_len, int array_type,
+	DBusMessageIter *iter, int array_type,
 	struct wpa_dbus_dict_entry *entry)
 {
 	dbus_uint32_t count = 0;
@@ -677,13 +699,7 @@ static dbus_bool_t _wpa_dbus_dict_entry_
 	entry->strarray_value = NULL;
 	entry->array_type = DBUS_TYPE_STRING;
 
-	/* Zero-length arrays are valid. */
-	if (array_len == 0) {
-		success = TRUE;
-		goto done;
-	}
-
-	buffer = wpa_zalloc(sizeof (char *) * 8);
+	buffer = wpa_zalloc(STR_ARRAY_ITEM_SIZE * STR_ARRAY_CHUNK_SIZE);
 	if (buffer == NULL) {
 		perror("_wpa_dbus_dict_entry_get_string_array[dbus] out of "
 		       "memory trying to retrieve a string array");
@@ -696,18 +712,14 @@ static dbus_bool_t _wpa_dbus_dict_entry_
 		const char *value;
 		char *str;
 
-		if ((count % 8) == 0 && count != 0) {
-			char **tmp;
-			tmp = realloc(buffer, sizeof(char *) * (count + 8));
-			if (tmp == NULL) {
+		if ((count % STR_ARRAY_CHUNK_SIZE) == 0 && count != 0) {
+			buffer = realloc(buffer, STR_ARRAY_ITEM_SIZE * (count + STR_ARRAY_CHUNK_SIZE));
+			if (buffer == NULL) {
 				perror("_wpa_dbus_dict_entry_get_string_array["
 				       "dbus] out of memory trying to "
 				       "retrieve the string array");
-				free(buffer);
-				buffer = NULL;
 				goto done;
 			}
-			buffer = tmp;
 		}
 		entry->strarray_value = buffer;
 
@@ -723,6 +735,13 @@ static dbus_bool_t _wpa_dbus_dict_entry_
 		entry->array_len = ++count;
 		dbus_message_iter_next(iter);
 	}
+
+	/* Zero-length arrays are valid. */
+	if (entry->array_len == 0) {
+		free(entry->strarray_value);
+		entry->strarray_value = NULL;
+	}
+
 	success = TRUE;
 
 done:
@@ -734,7 +753,6 @@ static dbus_bool_t _wpa_dbus_dict_entry_
 	DBusMessageIter *iter_dict_val, struct wpa_dbus_dict_entry *entry)
 {
 	int array_type = dbus_message_iter_get_element_type(iter_dict_val);
-	int array_len;
 	dbus_bool_t success = FALSE;
 	DBusMessageIter iter_array;
 
@@ -743,20 +761,14 @@ static dbus_bool_t _wpa_dbus_dict_entry_
 
 	dbus_message_iter_recurse(iter_dict_val, &iter_array);
 
- 	array_len = dbus_message_iter_get_array_len(&iter_array);
-	if (array_len < 0)
-		return FALSE;
-
  	switch (array_type) {
 	case DBUS_TYPE_BYTE:
 		success = _wpa_dbus_dict_entry_get_byte_array(&iter_array,
-							      array_len,
 							      array_type,
 							      entry);
 		break;
 	case DBUS_TYPE_STRING:
 		success = _wpa_dbus_dict_entry_get_string_array(&iter_array,
-								array_len,
 								array_type,
 								entry);
 		break;
@@ -943,9 +955,17 @@ void wpa_dbus_dict_entry_clear(struct wp
 		break;
 	case DBUS_TYPE_ARRAY:
 		switch (entry->array_type) {
-		case DBUS_TYPE_BYTE:
-			free(entry->bytearray_value);
-			break;
+		case DBUS_TYPE_BYTE: {
+				free(entry->bytearray_value);
+				break;
+			}
+		case DBUS_TYPE_STRING: {
+				int i;
+				for (i = 0; i < entry->array_len; i++)
+					free (entry->strarray_value[i]);
+				free (entry->strarray_value);
+				break;
+			}
 		}
 		break;
 	}