generic-library/libupnp
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix memory leak and access violation in UpnpSendAction(Ex)Async.

Browse Source 
Free buffers after malloc or ixmlPrintNode failure.
Free Param->Header before destructing Param.
(cherry picked from commit d9e90499b7)
This commit is contained in:
Yoichi NAKAYAMA 2012-06-19 19:13:46 +09:00 committed by Marcelo Roberto Jimenez
parent 4d88a2a4ea
commit f67de332a1
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -332,6 +332,13 @@ Version 1.8.0
Version 1.6.18 Version 1.6.18
******************************************************************************* *******************************************************************************
2012-06-19 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
Fix memory leak and access violation in UpnpSendAction(Ex)Async.
Free buffers after malloc or ixmlPrintNode failure.
Free Param->Header before destructing Param.
2012-05-25 Anoop Mohan <anoop.anoop(at)gmail.com> 2012-05-25 Anoop Mohan <anoop.anoop(at)gmail.com>
This patch fixes a bug in non blocking connect call where the sock This patch fixes a bug in non blocking connect call where the sock

6
upnp/src/api/upnpapi.c
View File

@ -2769,6 +2769,7 @@ int UpnpSendActionAsync(
malloc( sizeof( struct UpnpNonblockParam ) ); malloc( sizeof( struct UpnpNonblockParam ) );
if( Param == NULL ) { if( Param == NULL ) {
ixmlFreeDOMString( tmpStr );
return UPNP_E_OUTOF_MEMORY; return UPNP_E_OUTOF_MEMORY;
} }
memset( Param, 0, sizeof( struct UpnpNonblockParam ) ); memset( Param, 0, sizeof( struct UpnpNonblockParam ) );
@ -2862,6 +2863,7 @@ int UpnpSendActionExAsync(
tmpStr = ixmlPrintNode( ( IXML_Node * ) Act ); tmpStr = ixmlPrintNode( ( IXML_Node * ) Act );
if( tmpStr == NULL ) { if( tmpStr == NULL ) {
ixmlFreeDOMString( headerStr );
return UPNP_E_INVALID_ACTION; return UPNP_E_INVALID_ACTION;
} }
@ -2869,6 +2871,8 @@ int UpnpSendActionExAsync(
( struct UpnpNonblockParam * ) ( struct UpnpNonblockParam * )
malloc( sizeof( struct UpnpNonblockParam ) ); malloc( sizeof( struct UpnpNonblockParam ) );
if( Param == NULL ) { if( Param == NULL ) {
ixmlFreeDOMString( tmpStr );
ixmlFreeDOMString( headerStr );
return UPNP_E_OUTOF_MEMORY; return UPNP_E_OUTOF_MEMORY;
} }
memset( Param, 0, sizeof( struct UpnpNonblockParam ) ); memset( Param, 0, sizeof( struct UpnpNonblockParam ) );
@ -2892,10 +2896,10 @@ int UpnpSendActionExAsync(
retVal = ixmlParseBufferEx( tmpStr, &( Param->Act ) ); retVal = ixmlParseBufferEx( tmpStr, &( Param->Act ) );
if( retVal != IXML_SUCCESS ) { if( retVal != IXML_SUCCESS ) {
ixmlDocument_free( Param->Header );
free( Param ); free( Param );
ixmlFreeDOMString( tmpStr ); ixmlFreeDOMString( tmpStr );
ixmlFreeDOMString( headerStr ); ixmlFreeDOMString( headerStr );
ixmlDocument_free( Param->Header );
if( retVal == IXML_INSUFFICIENT_MEMORY ) { if( retVal == IXML_INSUFFICIENT_MEMORY ) {
return UPNP_E_OUTOF_MEMORY; return UPNP_E_OUTOF_MEMORY;
} else { } else {