Skip to content

Commit

Permalink
DB URL parser: Avoid double free on missing URL DB
Browse files Browse the repository at this point in the history
On URLs such as:
    mysql://opensips:opensipsrw@master.naudb.service.consul

... the DB URL parser would perform a double free within the error
handling code.

Reported by Kirill Galinurov
  • Loading branch information
liviuchircu committed Jun 21, 2019
1 parent 0a8cf74 commit cba9963
Showing 1 changed file with 3 additions and 5 deletions.
8 changes: 3 additions & 5 deletions db/db_id.c
Expand Up @@ -88,7 +88,7 @@ static int parse_db_url(struct db_id* id, const str* url)
enum state st;
unsigned int len, i, ipv6_flag = 0;
const char* begin;
char* prev_token;
char* prev_token = NULL;

if (!id || !url || !url->s) {
return -1;
Expand All @@ -103,7 +103,6 @@ static int parse_db_url(struct db_id* id, const str* url)
memset(id, 0, sizeof(struct db_id));
st = ST_SCHEME;
begin = url->s;
prev_token = 0;

for(i = 0; i < len; i++) {
switch(st) {
Expand Down Expand Up @@ -169,13 +168,13 @@ static int parse_db_url(struct db_id* id, const str* url)
switch(url->s[i]) {
case '@':
st = ST_HOST;
id->username = prev_token;
id->username = prev_token; prev_token = NULL;
if (dupl_string(&id->password, begin, url->s + i) < 0) goto err;
begin = url->s + i + 1;
break;

case '/':
id->host = prev_token;
id->host = prev_token; prev_token = NULL;
id->port = str2s(begin, url->s + i - begin, 0);
st = ST_DB;
begin = url->s + i + 1;
Expand Down Expand Up @@ -277,7 +276,6 @@ struct db_id* new_db_id(const str* url)
}
memset(ptr, 0, sizeof(struct db_id));


if (parse_db_url(ptr, url) < 0) {
LM_ERR("error while parsing database URL: '%.*s' \n", url->len, url->s);
goto err;
Expand Down

0 comments on commit cba9963

Please sign in to comment.