generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

SF Bug Tracker id 3495616 - Memory leak in ixmlElement_setAttributeNS

Browse Source 
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-29 02:09:43 PST

newAttrNode is not freed if newAttr->n.nodeValue = strdup(value); returns
NULL or if ixmlElement_setAttributeNodeNS(element, newAttr, NULL) does
not return IXML_SUCCESS.
(cherry picked from commit a79a149e6a77946701ab32a54eb95f734461ee24)
This commit is contained in:
Fabrice Fontaine 2012-02-29 12:11:40 +01:00 committed by Marcelo Roberto Jimenez
parent 89c174cc71
commit b4cc5df288
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -299,6 +299,16 @@ Version 1.8.0
Version 1.6.16
*******************************************************************************
2012-02-29 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3495616 - Memory leak in ixmlElement_setAttributeNS
Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-29 02:09:43 PST
newAttrNode is not freed if newAttr->n.nodeValue = strdup(value); returns
NULL or if ixmlElement_setAttributeNodeNS(element, newAttr, NULL) does
not return IXML_SUCCESS.
2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
SF Bug Tracker id 3495286 - Double free in get_action_node

4
ixml/src/element.c
View File

@ -2,6 +2,7 @@
*
* Copyright (c) 2000-2003 Intel Corporation
* All rights reserved.
* Copyright (c) 2012 France Telecom All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
@ -492,15 +493,18 @@ int ixmlElement_setAttributeNS(
qualifiedName,
&newAttr);
if (rc != IXML_SUCCESS) {
Parser_freeNodeContent(&newAttrNode);
return rc;
}
newAttr->n.nodeValue = strdup(value);
if (newAttr->n.nodeValue == NULL) {
ixmlAttr_free(newAttr);
Parser_freeNodeContent(&newAttrNode);
return IXML_INSUFFICIENT_MEMORY;
}
if (ixmlElement_setAttributeNodeNS(element, newAttr, NULL) != IXML_SUCCESS) {
ixmlAttr_free(newAttr);
Parser_freeNodeContent(&newAttrNode);
return IXML_FAILED;
}
}