generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Remove possibility of access violation.

Browse Source 
1. Test Instr before dereference it in http_RecvPostMessage.
(Though it never becomes NULL because NULL is not passed to
the static method)
2. Avoid strdup(NULL) in ixmlElement_setAttributeNS.
Those are detected by llvm scan-build.
(cherry picked from commit a383cbb8e2)
This commit is contained in:
Yoichi NAKAYAMA 2012-04-06 23:21:18 +09:00 committed by Marcelo Roberto Jimenez
parent 79d4b583fe
commit 77559473c1
3 changed files with 19 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -332,6 +332,16 @@ Version 1.8.0
Version 1.6.18
*******************************************************************************
2012-04-06 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
Remove possibility of access violation.
1. Test Instr before dereference it in http_RecvPostMessage.
(Though it never becomes NULL because NULL is not passed to
the static method)
2. Avoid strdup(NULL) in ixmlElement_setAttributeNS.
Those are detected by llvm scan-build.
2012-04-05 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
SF Bug Tracker id 3507819 - Use of thread-unsafe gmtime() in httpreadwrite.c

3
ixml/src/element.c
View File

@ -455,11 +455,14 @@ int ixmlElement_setAttributeNS(
free(attrNode->prefix);
}
/* replace it with the new prefix */
if (newAttrNode.prefix != NULL) {
attrNode->prefix = strdup( newAttrNode.prefix );
if (attrNode->prefix == NULL) {
Parser_freeNodeContent(&newAttrNode);
return IXML_INSUFFICIENT_MEMORY;
}
} else
attrNode->prefix = newAttrNode.prefix;
if (attrNode->nodeValue != NULL) {
free(attrNode->nodeValue);

2
upnp/src/genlib/net/http/webserver.c
View File

@ -1443,7 +1443,7 @@ static int http_RecvPostMessage(
&parser->msg.msg.buf[parser->entity_start_position + entity_offset],
Data_Buf_Size);
entity_offset += Data_Buf_Size;
if (Instr->IsVirtualFile) {
if (Instr && Instr->IsVirtualFile) {
int n = virtualDirCallback.write(Fp, Buf, Data_Buf_Size);
if (n < 0) {
ret_code = HTTP_INTERNAL_SERVER_ERROR;