generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3495286 - Double free in get_action_node

Browse Source 
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-28 04:27:54 PST

ixmlFreeDOMString(ActNodeName); is called twice if
ixmlParseBufferEx(ActNodeName, RespNode); does not return IXML_SUCCESS.
This commit is contained in:
Fabrice Fontaine 2012-02-28 14:31:59 +01:00 committed by Fabrice Fontaine
parent 076f8e5be6
commit 0693adc7dc
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -2,6 +2,15 @@
Version 1.6.16 Version 1.6.16
******************************************************************************* *******************************************************************************
2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3495286 - Double free in get_action_node
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-28 04:27:54 PST
ixmlFreeDOMString(ActNodeName); is called twice if
ixmlParseBufferEx(ActNodeName, RespNode); does not return IXML_SUCCESS.
2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com> 2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3495280 - Memory leak in ixmlDocument_createElementEx SF Bug Tracker id 3495280 - Memory leak in ixmlDocument_createElementEx

2
upnp/src/soap/soap_device.c
View File

@ -2,6 +2,7 @@
* *
* Copyright (c) 2000-2003 Intel Corporation * Copyright (c) 2000-2003 Intel Corporation
* All rights reserved. * All rights reserved.
* Copyright (c) 2012 France Telecom All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met: * modification, are permitted provided that the following conditions are met:
@ -322,7 +323,6 @@ static UPNP_INLINE int get_action_node(
goto error_handler; goto error_handler;
ret_code = ixmlParseBufferEx(ActNodeName, RespNode); ret_code = ixmlParseBufferEx(ActNodeName, RespNode);
if (ret_code != IXML_SUCCESS) { if (ret_code != IXML_SUCCESS) {
ixmlFreeDOMString(ActNodeName);
ret_code = -1; ret_code = -1;
goto error_handler; goto error_handler;
} }