From 4f978fe4dbc53cdae952b9df5d618cf8d9023dcb Mon Sep 17 00:00:00 2001
From: Adrien Destugues <pulkomandy@gmail.com>
Date: Sat, 18 Oct 2014 10:07:52 +0200
Subject: [PATCH] BNetBuffer: add some error checks.

The allocation of fImpl can fail, and some methods used it without
checking. Return an error code (or NULL or 0) instead of crashing in
these cases.

Also InitCheck the fInputBuffer in BHttpRequest before trying to use it.

Fixes #11350.
---
 src/kits/network/libnetapi/HttpRequest.cpp |  4 ++++
 src/kits/network/libnetapi/NetBuffer.cpp   | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/src/kits/network/libnetapi/HttpRequest.cpp b/src/kits/network/libnetapi/HttpRequest.cpp
index a017a21284..c99976d13f 100644
--- a/src/kits/network/libnetapi/HttpRequest.cpp
+++ b/src/kits/network/libnetapi/HttpRequest.cpp
@@ -330,6 +330,10 @@ BHttpRequest::_ProtocolLoop()
 			port = fContext->GetProxyPort();
 		}
 
+		status_t result = fInputBuffer.InitCheck();
+		if (result != B_OK)
+			return result;
+
 		if (!_ResolveHostName(host, port)) {
 			_EmitDebug(B_URL_PROTOCOL_DEBUG_ERROR,
 				"Unable to resolve hostname (%s), aborting.",
diff --git a/src/kits/network/libnetapi/NetBuffer.cpp b/src/kits/network/libnetapi/NetBuffer.cpp
index b0b8d956cd..5bc5869696 100644
--- a/src/kits/network/libnetapi/NetBuffer.cpp
+++ b/src/kits/network/libnetapi/NetBuffer.cpp
@@ -185,6 +185,9 @@ BNetBuffer::AppendString(const char* data)
 status_t
 BNetBuffer::AppendData(const void* data, size_t size)
 {
+	if (fInit != B_OK)
+		return B_NO_INIT;
+
 	ssize_t bytesWritten = fImpl->Write(data, size);
 	if (bytesWritten < 0)
 		return (status_t)bytesWritten;
@@ -335,6 +338,9 @@ BNetBuffer::RemoveString(char* data, size_t size)
 status_t
 BNetBuffer::RemoveData(void* data, size_t size)
 {
+	if (fInit != B_OK)
+		return B_NO_INIT;
+
 	ssize_t bytesRead = fImpl->Read(data, size);
 	if (bytesRead < 0)
 		return (status_t)bytesRead;
@@ -345,6 +351,9 @@ BNetBuffer::RemoveData(void* data, size_t size)
 status_t
 BNetBuffer::RemoveMessage(BMessage& data)
 {
+	if (fInit != B_OK)
+		return B_NO_INIT;
+
 	unsigned char* bufferPtr = fImpl->Data();
 
 	if (*(int32*)bufferPtr != B_MESSAGE_TYPE)
@@ -398,6 +407,9 @@ BNetBuffer::RemoveUint64(uint64& data)
 unsigned char*
 BNetBuffer::Data() const
 {
+	if (fInit != B_OK)
+		return NULL;
+
 	return fImpl->Data();
 }
 
@@ -405,6 +417,9 @@ BNetBuffer::Data() const
 size_t
 BNetBuffer::Size() const
 {
+	if (fInit != B_OK)
+		return 0;
+
 	return fImpl->Size();
 }
 
@@ -412,6 +427,9 @@ BNetBuffer::Size() const
 size_t
 BNetBuffer::BytesRemaining() const
 {
+	if (fInit != B_OK)
+		return 0;
+
 	return fImpl->BytesRemaining();
 }