fujin/rtorrent
1
0
Fork 0
mirror of https://github.com/rakshasa/rtorrent.git synced 2026-10-13 20:56:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix a use after free in the xmlrpc-c index path

Browse Source 
The string was freed before it was tested, and tmp was never released.
This commit is contained in:
noctuum
2026-09-13 08:46:51 +05:00
committed by Jari Sundell
parent c41e63248a
commit 282c86597a
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/rpc/xmlrpc_c.cc
+3 -1
View File
@@ -77,16 +77,18 @@ xmlrpc_list_entry_to_value(xmlrpc_env* env, xmlrpc_value* src, int index) {
{ {
const char* str; const char* str;
xmlrpc_read_string(env, tmp, &str); xmlrpc_read_string(env, tmp, &str);
xmlrpc_DECREF(tmp);
if (env->fault_occurred) if (env->fault_occurred)
throw xmlrpc_error_c(env); throw xmlrpc_error_c(env);
const char* end = str; const char* end = str;
int64_t v3 = ::strtoll(str, (char**)&end, 0); int64_t v3 = ::strtoll(str, (char**)&end, 0);
bool invalid = *str == '\0' || *end != '\0';
::free((void*)str); ::free((void*)str);
if (*str == '\0' || *end != '\0') if (invalid)
throw xmlrpc_error_c(XMLRPC_TYPE_ERROR, "Invalid index."); throw xmlrpc_error_c(XMLRPC_TYPE_ERROR, "Invalid index.");
return v3; return v3;