--- /dev/null
+From 1351de749ab46d276db3de94beea07b1c66c9b6e Mon Sep 17 00:00:00 2001
+From: Scott James Remnant <scott@ubuntu.com>
+Date: Tue, 16 Jun 2009 16:47:32 +0100
+Subject: [PATCH] bfo22316 - add dbus_message_iter_abandon_container()
+
+It's not currently possible to abandon creation of a container without
+either hitting asserts or leaking memory. This new function allows
+that.
+
+Signed-off-by: Scott James Remnant <scott@ubuntu.com>
+---
+ dbus/dbus-message.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ dbus/dbus-message.h | 2 +
+ 2 files changed, 57 insertions(+), 0 deletions(-)
+
+diff --git a/dbus/dbus-message.c b/dbus/dbus-message.c
+index edae425..30b5d6c 100644
+--- a/dbus/dbus-message.c
++++ b/dbus/dbus-message.c
+@@ -2200,6 +2200,35 @@ _dbus_message_iter_close_signature (DBusMessageRealIter *real)
+ return retval;
+ }
+
++/**
++ * Frees the signature string and marks the iterator as not having a
++ * type_str anymore. Since the new signature is not set, the message
++ * will generally be hosed after this is called.
++ *
++ * @param real an iterator without a type_str
++ */
++static void
++_dbus_message_iter_abandon_signature (DBusMessageRealIter *real)
++{
++ DBusString *str;
++
++ _dbus_assert (real->iter_type == DBUS_MESSAGE_ITER_TYPE_WRITER);
++ _dbus_assert (real->u.writer.type_str != NULL);
++ _dbus_assert (real->sig_refcount > 0);
++
++ real->sig_refcount -= 1;
++
++ if (real->sig_refcount > 0)
++ return;
++ _dbus_assert (real->sig_refcount == 0);
++
++ str = real->u.writer.type_str;
++
++ _dbus_type_writer_remove_types (&real->u.writer);
++ _dbus_string_free (str);
++ dbus_free (str);
++}
++
+ #ifndef DBUS_DISABLE_CHECKS
+ static dbus_bool_t
+ _dbus_message_iter_append_check (DBusMessageRealIter *iter)
+@@ -2428,6 +2457,32 @@ dbus_message_iter_close_container (DBusMessageIter *iter,
+ }
+
+ /**
++ * Abandons creation of a contained-typed value and frees resources created
++ * by dbus_message_iter_open_container(). Once this returns, the message
++ * is hosed and you have to start over building the whole message.
++ *
++ * This should only be used to abandon creation of a message when you have
++ * open containers.
++ *
++ * @param iter the append iterator
++ * @param sub sub-iterator to close
++ */
++void
++dbus_message_iter_abandon_container (DBusMessageIter *iter,
++ DBusMessageIter *sub)
++{
++ DBusMessageRealIter *real = (DBusMessageRealIter *)iter;
++ DBusMessageRealIter *real_sub = (DBusMessageRealIter *)sub;
++
++ _dbus_return_if_fail (_dbus_message_iter_append_check (real));
++ _dbus_return_if_fail (real->iter_type == DBUS_MESSAGE_ITER_TYPE_WRITER);
++ _dbus_return_if_fail (_dbus_message_iter_append_check (real_sub));
++ _dbus_return_if_fail (real_sub->iter_type == DBUS_MESSAGE_ITER_TYPE_WRITER);
++
++ _dbus_message_iter_abandon_signature (real);
++}
++
++/**
+ * Sets a flag indicating that the message does not want a reply; if
+ * this flag is set, the other end of the connection may (but is not
+ * required to) optimize by not sending method return or error
+diff --git a/dbus/dbus-message.h b/dbus/dbus-message.h
+index 2e29fef..49c7e72 100644
+--- a/dbus/dbus-message.h
++++ b/dbus/dbus-message.h
+@@ -197,6 +197,8 @@ dbus_bool_t dbus_message_iter_open_container (DBusMessageIter *iter,
+ DBusMessageIter *sub);
+ dbus_bool_t dbus_message_iter_close_container (DBusMessageIter *iter,
+ DBusMessageIter *sub);
++void dbus_message_iter_abandon_container (DBusMessageIter *iter,
++ DBusMessageIter *sub);
+
+ void dbus_message_lock (DBusMessage *message);
+
+--
+1.6.0.5
+
+From da88126b7bfc3abfc77f8b18dda97517e4d6e014 Mon Sep 17 00:00:00 2001
+From: Scott James Remnant <scott@ubuntu.com>
+Date: Tue, 16 Jun 2009 17:03:23 +0100
+Subject: [PATCH] dbus_message_append_args_valist - abandon container
+
+In case of OOM when constructing an array, we should abandon the
+container to free the resources.
+
+Signed-off-by: Scott James Remnant <scott@ubuntu.com>
+---
+ dbus/dbus-message.c | 8 ++++++--
+ 1 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/dbus/dbus-message.c b/dbus/dbus-message.c
+index 30b5d6c..98c284e 100644
+--- a/dbus/dbus-message.c
++++ b/dbus/dbus-message.c
+@@ -1567,8 +1567,10 @@ dbus_message_append_args_valist (DBusMessage *message,
+ if (!dbus_message_iter_append_fixed_array (&array,
+ element_type,
+ value,
+- n_elements))
++ n_elements)) {
++ dbus_message_iter_abandon_container (&iter, &array);
+ goto failed;
++ }
+ }
+ else if (element_type == DBUS_TYPE_STRING ||
+ element_type == DBUS_TYPE_SIGNATURE ||
+@@ -1589,8 +1591,10 @@ dbus_message_append_args_valist (DBusMessage *message,
+ {
+ if (!dbus_message_iter_append_basic (&array,
+ element_type,
+- &value[i]))
++ &value[i])) {
++ dbus_message_iter_abandon_container (&iter, &array);
+ goto failed;
++ }
+ ++i;
+ }
+ }
+--
+1.6.0.5
+