Fix a use after free in the xmlrpc-c index path

The string was freed before it was tested, and tmp was never released.

src/command_ip.cc

@@ -131,7 +131,7 @@ ipv4_range_parse(const char* address, uint32_t* address_start, uint32_t* address
   // copy everything up to '#'  to address_copy and work from there
   while(address[address_start_index] != '#' && address[address_start_index] != '\r' &&
         address[address_start_index] != '\n' && address[address_start_index] != '\0' &&
-        address_start_index < 4096 ) {
+        address_start_index < 4095 ) {
 
     address_copy[address_start_index] = address[address_start_index];
     address_start_index++;

src/rpc/xmlrpc_c.cc

@@ -77,16 +77,18 @@ xmlrpc_list_entry_to_value(xmlrpc_env* env, xmlrpc_value* src, int index) {
   {
     const char* str;
     xmlrpc_read_string(env, tmp, &str);
+    xmlrpc_DECREF(tmp);
 
     if (env->fault_occurred)
       throw xmlrpc_error_c(env);
 
     const char* end = str;
     int64_t v3 = ::strtoll(str, (char**)&end, 0);
+    bool invalid = *str == '\0' || *end != '\0';
 
     ::free((void*)str);
 
-    if (*str == '\0' || *end != '\0')
+    if (invalid)
       throw xmlrpc_error_c(XMLRPC_TYPE_ERROR, "Invalid index.");
 
     return v3;

src/session/download_storer.cc

@@ -127,8 +127,12 @@ save_stream(const std::string& path, bool use_fsyncdisk, const std::stringstream
   if (!output.good())
     throw torrent::storage_error("failed to write stream to file : " + path);
 
+  // The data only reaches the kernel here, so this is where a full disk is seen.
   output.close();
 
+  if (!output.good())
+    throw torrent::storage_error("failed to flush stream to file : " + path);
+
   // Ensure that the new file is actually written to the disk
   int fd = ::open(path.c_str(), O_WRONLY);
 
@@ -137,13 +141,19 @@ save_stream(const std::string& path, bool use_fsyncdisk, const std::stringstream
 
   if (use_fsyncdisk) {
 #ifdef __APPLE__
-    ::fsync(fd);
+    int sync_result = ::fsync(fd);
 #else
-    ::fdatasync(fd);
+    int sync_result = ::fdatasync(fd);
 #endif
+
+    if (sync_result == -1) {
+      ::close(fd);
+      throw torrent::storage_error("failed to sync file to disk : " + path);
+    }
   }
 
-  ::close(fd);
+  if (::close(fd) == -1)
+    throw torrent::storage_error("failed to close file descriptor : " + path);
 }
 
 } // namespace anonymous