generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3325246 - Memory Leak in XML Parser

Browse Source 
Submitted: Terry Farnham ( tfarnham ) - 2011-06-23 09:45:54 PDT

Details: The following bit of xml results in a memory leak from the xml
parser:

const char *xmlbuffer="<?xml version=\"1.0\" encoding=\"utf-8\"?>
<root xmlns=\"urn:schemas-upnp-org:device-1-0\" xmlns:dlna=\"urn:schemas-dlna-org:device-1-0\">
<dlna:X_DLNADOC xmlns:dlna=\"urn:schemas-dlna-org:device-1-0\">DMS-1.50</dlna:X_DLNADOC></root>";

When I execute the following code:

IXML_Document *doc = ixmlParseBuffer(xmlbuffer);
ixmlDocument_free(doc);

It results in a memory leak in ixmlparser.c line 2107 where it calls
safe_strdup( newElement->namespaceURI ); It's difficult to figure out why.
(cherry picked from commit d6f1e4112ec112a0e4e401fa95589ab5eae000c6)
This commit is contained in:
Yoichi NAKAYAMA 2012-03-05 16:59:15 -03:00 committed by Marcelo Roberto Jimenez
parent 8ffb52e330
commit 2c7658f98a
2 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
ChangeLog
View File

@ -299,6 +299,27 @@ Version 1.8.0
Version 1.6.16 Version 1.6.16
******************************************************************************* *******************************************************************************
2012-03-05 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
SF Bug Tracker id 3325246 - Memory Leak in XML Parser
Submitted: Terry Farnham ( tfarnham ) - 2011-06-23 09:45:54 PDT
Details: The following bit of xml results in a memory leak from the xml
parser:
const char *xmlbuffer="<?xml version=\"1.0\" encoding=\"utf-8\"?>
<root xmlns=\"urn:schemas-upnp-org:device-1-0\" xmlns:dlna=\"urn:schemas-dlna-org:device-1-0\">
<dlna:X_DLNADOC xmlns:dlna=\"urn:schemas-dlna-org:device-1-0\">DMS-1.50</dlna:X_DLNADOC></root>";
When I execute the following code:
IXML_Document *doc = ixmlParseBuffer(xmlbuffer);
ixmlDocument_free(doc);
It results in a memory leak in ixmlparser.c line 2107 where it calls
safe_strdup( newElement->namespaceURI ); It's difficult to figure out why.
2012-03-05 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net> 2012-03-05 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
SF Bug Tracker id 3417134 - Crash seen in UpnpFinish SF Bug Tracker id 3417134 - Crash seen in UpnpFinish

3
ixml/src/ixmlparser.c
View File

@ -1593,6 +1593,9 @@ static int Parser_xmlNamespace(
} }
if (pCur->prefix != NULL && if (pCur->prefix != NULL &&
strcmp(pCur->prefix, newNode->localName) == 0) { strcmp(pCur->prefix, newNode->localName) == 0) {
if (pCur->namespaceUri != NULL) {
free(pCur->namespaceUri);
}
pCur->namespaceUri = safe_strdup(newNode->nodeValue); pCur->namespaceUri = safe_strdup(newNode->nodeValue);
if (pCur->namespaceUri == NULL) { if (pCur->namespaceUri == NULL) {
ret = IXML_INSUFFICIENT_MEMORY; ret = IXML_INSUFFICIENT_MEMORY;