[PATCH] server: Fix bogus port deallocation on server error

[Samuel Thibault]

For inlined port arrays, WriteExtractArg compacts them from a
mach_port_name_inlined_t array to a mach_port_t array, reusing the
memory area. But when the server returns an error, the caller will
destroy the message, and thus expects the original inlined port arrays
available.

Index: mig-1.8+git20231217/server.c
===================================================================
--- mig-1.8+git20231217.orig/server.c
+++ mig-1.8+git20231217/server.c
@@ -790,6 +790,27 @@ WriteExtractArg(FILE *file, const argume
 }
 
 static void
+WriteRestoreArg(FILE *file, const argument_t *arg)
+{
+    if (akCheckAll(arg->argKind, akbSendRcv|akbPointer)) {
+       if (akCheck(arg->argKind, akbIndefinite)) {
+           fprintf(file, "\tif (OutP->%s != KERN_SUCCESS && 
In%dP->%s%s.msgt_inline) {\n",
+                   arg->argRoutine->rtRetCode->argMsgField,
+                   arg->argRequestPos, arg->argTTName, arg->argLongForm ? 
".msgtl_header" : "");
+           fprintf(file, "\t\tmach_msg_type_number_t i;\n");
+           fprintf(file, "\t\t/* Restore the mach_port_name_inlined_t input 
array for message destruction. */\n");
+           fprintf(file, "\t\tfor (i = In%dP->%s.msgt%s_number - 1; i > 0; 
i--) {\n",
+                   arg->argRequestPos, arg->argTTName, arg->argLongForm ? "l" 
: "");
+           fprintf(file, "\t\t\t%s[i].name = %sP[i];\n", InArgMsgField(arg), 
arg->argVarName);
+           fprintf(file, "\t\t}\n");
+           fprintf(file, "\t}\n");
+       }
+       else
+           assert(false);
+    }
+}
+
+static void
 WriteServerCallArg(FILE *file, const argument_t *arg)
 {
     const ipc_type_t *it = arg->argType;
@@ -1436,6 +1457,8 @@ WriteRoutine(FILE *file, const routine_t
     WriteServerCall(file, rt);
     WriteGetReturnValue(file, rt);
 
+    WriteReverseList(file, rt->rtArgs, WriteRestoreArg, akbNone, "", "");
+
     WriteReverseList(file, rt->rtArgs, WriteDestroyArg, akbDestroy, "", "");
 
     /*