generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3495286 - Double free in get_action_node

Browse Source 
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-28 04:27:54 PST

ixmlFreeDOMString(ActNodeName); is called twice if
ixmlParseBufferEx(ActNodeName, RespNode); does not return IXML_SUCCESS.
(cherry picked from commit 0693adc7dc)
This commit is contained in:
Fabrice Fontaine
2012-02-28 14:31:59 +01:00
committed by Marcelo Roberto Jimenez
parent b441c6f4a8
commit 89c174cc71
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@@ -299,6 +299,15 @@ Version 1.8.0
Version 1.6.16 Version 1.6.16
******************************************************************************* *******************************************************************************
2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3495286 - Double free in get_action_node
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-28 04:27:54 PST
ixmlFreeDOMString(ActNodeName); is called twice if
ixmlParseBufferEx(ActNodeName, RespNode); does not return IXML_SUCCESS.
2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com> 2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3495280 - Memory leak in ixmlDocument_createElementEx SF Bug Tracker id 3495280 - Memory leak in ixmlDocument_createElementEx

2
upnp/src/soap/soap_device.c
View File

@@ -2,6 +2,7 @@
* *
* Copyright (c) 2000-2003 Intel Corporation * Copyright (c) 2000-2003 Intel Corporation
* All rights reserved. * All rights reserved.
* Copyright (c) 2012 France Telecom All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met: * modification, are permitted provided that the following conditions are met:
@@ -323,7 +324,6 @@ static UPNP_INLINE int get_action_node(
goto error_handler; goto error_handler;
ret_code = ixmlParseBufferEx(ActNodeName, RespNode); ret_code = ixmlParseBufferEx(ActNodeName, RespNode);
if (ret_code != IXML_SUCCESS) { if (ret_code != IXML_SUCCESS) {
ixmlFreeDOMString(ActNodeName);
ret_code = -1; ret_code = -1;
goto error_handler; goto error_handler;
} }