generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3495616 - Memory leak in ixmlElement_setAttributeNS

Browse Source 
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-29 02:09:43 PST

newAttrNode is not freed if newAttr->n.nodeValue = strdup(value); returns
NULL or if ixmlElement_setAttributeNodeNS(element, newAttr, NULL) does
not return IXML_SUCCESS.
This commit is contained in:
Fabrice Fontaine 2012-02-29 12:11:40 +01:00 committed by Fabrice Fontaine
parent 0693adc7dc
commit a79a149e6a
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -2,6 +2,16 @@
Version 1.6.16
*******************************************************************************
2012-02-29 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3495616 - Memory leak in ixmlElement_setAttributeNS
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-29 02:09:43 PST
newAttrNode is not freed if newAttr->n.nodeValue = strdup(value); returns
NULL or if ixmlElement_setAttributeNodeNS(element, newAttr, NULL) does
not return IXML_SUCCESS.
2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3495286 - Double free in get_action_node

4
ixml/src/element.c
View File

@ -2,6 +2,7 @@
*
* Copyright (c) 2000-2003 Intel Corporation
* All rights reserved.
* Copyright (c) 2012 France Telecom All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
@ -492,15 +493,18 @@ int ixmlElement_setAttributeNS(
qualifiedName,
&newAttr);
if (rc != IXML_SUCCESS) {
Parser_freeNodeContent(&newAttrNode);
return rc;
}
newAttr->n.nodeValue = strdup(value);
if (newAttr->n.nodeValue == NULL) {
ixmlAttr_free(newAttr);
Parser_freeNodeContent(&newAttrNode);
return IXML_INSUFFICIENT_MEMORY;
}
if (ixmlElement_setAttributeNodeNS(element, newAttr, NULL) != IXML_SUCCESS) {
ixmlAttr_free(newAttr);
Parser_freeNodeContent(&newAttrNode);
return IXML_FAILED;
}
}