generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3495286 - Double free in get_action_node

Browse Source 
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-28 04:27:54 PST

ixmlFreeDOMString(ActNodeName); is called twice if
ixmlParseBufferEx(ActNodeName, RespNode); does not return IXML_SUCCESS.
(cherry picked from commit 0693adc7dc978c6802d62b4368b0e87b6dfd2d6f)
This commit is contained in:
Fabrice Fontaine 2012-02-28 14:31:59 +01:00 committed by Marcelo Roberto Jimenez
parent b441c6f4a8
commit 89c174cc71
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -299,6 +299,15 @@ Version 1.8.0
Version 1.6.16
*******************************************************************************
2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3495286 - Double free in get_action_node
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-28 04:27:54 PST
ixmlFreeDOMString(ActNodeName); is called twice if
ixmlParseBufferEx(ActNodeName, RespNode); does not return IXML_SUCCESS.
2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3495280 - Memory leak in ixmlDocument_createElementEx

2
upnp/src/soap/soap_device.c
View File

@ -2,6 +2,7 @@
*
* Copyright (c) 2000-2003 Intel Corporation
* All rights reserved.
* Copyright (c) 2012 France Telecom All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
@ -323,7 +324,6 @@ static UPNP_INLINE int get_action_node(
goto error_handler;
ret_code = ixmlParseBufferEx(ActNodeName, RespNode);
if (ret_code != IXML_SUCCESS) {
ixmlFreeDOMString(ActNodeName);
ret_code = -1;
goto error_handler;
}