… bugs

Fix several pre-existing bugs in the OAuth2 device code flow:

• Use-after-free: otpd_queue_item_free() was called before the retry check in oauth2_on_child_writable(). On EAGAIN, the freed saved_item would be dereferenced on the next callback invocation.

• CVE-2026-14612: buffer overflow: read() into a 10240-byte buffer could return exactly 10240 bytes, causing buf[10240]='\0' to write past the end. Use sizeof(buf)-1 instead.

• Memory leaks: saved_item was leaked on strndup failure and on child_ctx allocation failure. The done: label now cleans up saved_item, pipe fds, and child_ctx on error paths.

• NULL dereference: ipaidpSub was dereferenced without a NULL check in check_access_token_reply().

• verto_add_child() return was not checked for NULL, leading to a NULL dereference on verto_set_private().

• set_fd_nonblocking() return values were silently ignored; a failure would leave pipes in blocking mode, hanging the daemon.

• Off-by-one in memchr length calculation for second newline.

• Avoid logging full oidc_child output (may contain tokens); log byte count instead.

• Fix error message for reader event (was copy-pasted as "writer").

• Fix uninitialized loop variable in disabled debug block.

Fixes: CVE-2026-14612

Summary by Sourcery

Harden the OAuth2 device code flow in ipa-otpd by fixing memory safety issues, improving error handling, and tightening child process I/O handling and logging.

Bug Fixes:

• Prevent a use-after-free when retrying writes to the oauth2 child by only freeing the saved queue item after I/O completes.
• Fix a potential buffer overflow and off-by-one error when reading and parsing the oauth2 child output buffer.
• Avoid NULL dereferences by validating ipaidpSub and verto child event allocations before use.
• Eliminate memory leaks on failures when allocating saved state or child context structures and when setting up pipes.
• Handle zero-length reads and failures from set_fd_nonblocking to avoid hangs and undefined behavior in the daemon.
• Correct an incorrect reader event error message and initialize a previously uninitialized loop variable in debug-only code.

Enhancements:

• Stop logging the full oidc_child output and instead log only the byte count to avoid exposing sensitive tokens.
• Ensure file descriptors and ownership (between parent and verto) are consistently tracked and closed on all error paths to improve robustness.