generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Memory leaks correction in upnpapi.c

Browse Source 
Fix memory leaks in UpnpUnSubscribe, SendActionExAsync and
RenewSubscription.
(cherry picked from commit 3ab8d536a02f8ea5b6b24e4ddb6325a44187b5c4)
This commit is contained in:
Fabrice Fontaine 2012-03-08 15:30:58 +01:00 committed by Marcelo Roberto Jimenez
parent bd41182cf3
commit 10805cb8cc
2 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -318,6 +318,13 @@ Version 1.8.0
Version 1.6.16 Version 1.6.16
******************************************************************************* *******************************************************************************
2012-03-08 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
Memory leaks correction in upnpapi.c
Fix memory leaks in UpnpUnSubscribe, SendActionExAsync and
RenewSubscription.
2012-03-08 Fabrice Fontaine <fabrice.fontaine(at)orange.com> 2012-03-08 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3496993 - Write after free in ixmlNode_insertBefore SF Bug Tracker id 3496993 - Write after free in ixmlNode_insertBefore

11
upnp/src/api/upnpapi.c
View File

@ -2024,8 +2024,8 @@ int UpnpUnSubscribe(UpnpClient_Handle Hnd, const Upnp_SID SubsId)
goto exit_function; goto exit_function;
} }
if (SubsId == NULL) { if (SubsId == NULL) {
HandleUnlock(); retVal = UPNP_E_INVALID_PARAM;
return UPNP_E_INVALID_PARAM; goto exit_function;
} }
UpnpString_set_String(SubsIdTmp, SubsId); UpnpString_set_String(SubsIdTmp, SubsId);
@ -2108,7 +2108,7 @@ int UpnpUnSubscribeAsync(
exit_function: exit_function:
UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, "Exiting UpnpUnSubscribeAsync\n"); UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, "Exiting UpnpUnSubscribeAsync\n");
return UPNP_E_SUCCESS; return retVal;
} }
#endif /* INCLUDE_CLIENT_APIS */ #endif /* INCLUDE_CLIENT_APIS */
@ -2126,7 +2126,8 @@ int UpnpRenewSubscription(
UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, "Inside UpnpRenewSubscription\n"); UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, "Inside UpnpRenewSubscription\n");
if (UpnpSdkInit != 1) { if (UpnpSdkInit != 1) {
return UPNP_E_FINISH; retVal = UPNP_E_FINISH;
goto exit_function;
} }
if (SubsIdTmp == NULL) { if (SubsIdTmp == NULL) {
@ -2752,6 +2753,7 @@ int UpnpSendActionExAsync(
sizeof ( Param->ServiceType ) - 1 ); sizeof ( Param->ServiceType ) - 1 );
retVal = ixmlParseBufferEx( headerStr, &( Param->Header ) ); retVal = ixmlParseBufferEx( headerStr, &( Param->Header ) );
if( retVal != IXML_SUCCESS ) { if( retVal != IXML_SUCCESS ) {
free( Param );
ixmlFreeDOMString( tmpStr ); ixmlFreeDOMString( tmpStr );
ixmlFreeDOMString( headerStr ); ixmlFreeDOMString( headerStr );
if( retVal == IXML_INSUFFICIENT_MEMORY ) { if( retVal == IXML_INSUFFICIENT_MEMORY ) {
@ -2763,6 +2765,7 @@ int UpnpSendActionExAsync(
retVal = ixmlParseBufferEx( tmpStr, &( Param->Act ) ); retVal = ixmlParseBufferEx( tmpStr, &( Param->Act ) );
if( retVal != IXML_SUCCESS ) { if( retVal != IXML_SUCCESS ) {
free( Param );
ixmlFreeDOMString( tmpStr ); ixmlFreeDOMString( tmpStr );
ixmlFreeDOMString( headerStr ); ixmlFreeDOMString( headerStr );
ixmlDocument_free( Param->Header ); ixmlDocument_free( Param->Header );