kenmirrors
/
freeswitch
mirror of https://github.com/signalwire/freeswitch.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

[Core] scan-build: Fix false-positive use-after-free in switch_xml_free_attr(). Add unit test.

This commit is contained in:
Andrey Volk 2021-04-25 03:52:33 +03:00
parent 95fb8c7773
commit e42ebbb33f
2 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/switch_xml.c
View File

@ -1000,15 +1000,15 @@ static char *switch_xml_str2utf8(char **s, switch_size_t *len)
/* frees a tag attribute list */
static void switch_xml_free_attr(char **attr)
{
int i = 0;
int i, c = 0;
char *m;
if (!attr || attr == SWITCH_XML_NIL)
return; /* nothing to free */
while (attr[i])
i += 2; /* find end of attribute list */
m = attr[i + 1]; /* list of which names and values are malloced */
for (i = 0; m[i]; i++) {
while (attr[c])
c += 2; /* find end of attribute list */
m = attr[c + 1]; /* list of which names and values are malloced */
for (i = c / 2 - 1; i >= 0 ; i--) {
if (m[i] & SWITCH_XML_NAMEM)
free(attr[i * 2]);
if (m[i] & SWITCH_XML_TXTM)

10
tests/unit/switch_core.c
View File

@ -53,6 +53,16 @@ FST_CORE_BEGIN("./conf")
}
FST_TEARDOWN_END()
FST_TEST_BEGIN(test_xml_free_attr)
{
switch_xml_t parent_xml = switch_xml_new("xml");
switch_xml_t xml = switch_xml_add_child_d(parent_xml, "test", 1);
switch_xml_set_attr(xml, "a1", "v1");
switch_xml_set_attr_d(xml, "a2", "v2");
switch_xml_free(parent_xml);
}
FST_TEST_END()
FST_TEST_BEGIN(test_xml_set_attr)
{
switch_xml_t parent_xml = switch_xml_new("xml");