lua: fix unchecked calloc and memory leak in ubus_lua_load_object

Two bugs in the method array allocation:

1. calloc(mlen, sizeof(struct ubus_method)) was not checked for NULL.
   On OOM the returned NULL pointer was stored in obj->o.methods and
   later dereferenced as m[midx], causing a crash.

2. calloc(0, N) has implementation-defined behaviour (may return NULL
   or a unique pointer). Treat mlen == 0 explicitly by setting m = NULL
   and skipping the allocation.

3. When the subsequent calloc for obj->o.type failed, the already-
   allocated method array 'm' was not freed, causing a memory leak.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/ubus/pull/20
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

1 files changed, 9 insertions, 2 deletions

diff --git a/lua/ubus.c b/lua/ubus.c
index 47dd837..7611fb0 100644
--- a/lua/ubus.c
+++ b/lua/ubus.c
@@ -491,7 +491,7 @@ static struct ubus_object* ubus_lua_load_object(lua_State *L)
 {
 	struct ubus_lua_object *obj = NULL;
 	int mlen = lua_gettablelen(L, -1);
-	struct ubus_method *m;
+	struct ubus_method *m = NULL;
 	int midx = 0;
 
 	/* setup object pointers */
@@ -502,12 +502,19 @@ static struct ubus_object* ubus_lua_load_object(lua_State *L)
 	obj->o.name = lua_tostring(L, -2);
 
 	/* setup method pointers */
-	m = calloc(mlen, sizeof(struct ubus_method));
+	if (mlen > 0) {
+		m = calloc(mlen, sizeof(struct ubus_method));
+		if (!m) {
+			free(obj);
+			return NULL;
+		}
+	}
 	obj->o.methods = m;
 
 	/* setup type pointers */
 	obj->o.type = calloc(1, sizeof(struct ubus_object_type));
 	if (!obj->o.type) {
+		free(m);
 		free(obj);
 		return NULL;
 	}