From 0693adc7dc978c6802d62b4368b0e87b6dfd2d6f Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Tue, 28 Feb 2012 14:31:59 +0100 Subject: [PATCH] SF Bug Tracker id 3495286 - Double free in get_action_node Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-28 04:27:54 PST ixmlFreeDOMString(ActNodeName); is called twice if ixmlParseBufferEx(ActNodeName, RespNode); does not return IXML_SUCCESS. --- ChangeLog | 9 +++++++++ upnp/src/soap/soap_device.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index fdc1af7..c179e29 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,6 +2,15 @@ Version 1.6.16 ******************************************************************************* +2012-02-28 Fabrice Fontaine + + SF Bug Tracker id 3495286 - Double free in get_action_node + + Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-28 04:27:54 PST + + ixmlFreeDOMString(ActNodeName); is called twice if + ixmlParseBufferEx(ActNodeName, RespNode); does not return IXML_SUCCESS. + 2012-02-28 Fabrice Fontaine SF Bug Tracker id 3495280 - Memory leak in ixmlDocument_createElementEx diff --git a/upnp/src/soap/soap_device.c b/upnp/src/soap/soap_device.c index 909cd33..7e4224d 100644 --- a/upnp/src/soap/soap_device.c +++ b/upnp/src/soap/soap_device.c @@ -2,6 +2,7 @@ * * Copyright (c) 2000-2003 Intel Corporation * All rights reserved. + * Copyright (c) 2012 France Telecom All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: @@ -322,7 +323,6 @@ static UPNP_INLINE int get_action_node( goto error_handler; ret_code = ixmlParseBufferEx(ActNodeName, RespNode); if (ret_code != IXML_SUCCESS) { - ixmlFreeDOMString(ActNodeName); ret_code = -1; goto error_handler; }