Fix memory leak on last array element

Reference: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2883 Credit to OSS-Fuzz
open62541 · Aug 7, 2017 · aa340f2 · aa340f2
1 parent 812bab5
commit aa340f2
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/ua_types_encoding_binary.c b/src/ua_types_encoding_binary.c
@@ -570,7 +570,8 @@ Array_decodeBinary(void *UA_RESTRICT *UA_RESTRICT dst,
         for(size_t i = 0; i < length; ++i) {
             retval = decodeBinaryJumpTable[decode_index]((void*)ptr, type);
             if(retval != UA_STATUSCODE_GOOD) {
-                UA_Array_delete(*dst, i, type);
+                // +1 because last element is also already initialized
+                UA_Array_delete(*dst, i+1, type);
                 *dst = NULL;
                 return retval;
             }
@@ -1466,7 +1467,7 @@ UA_decodeBinaryInternal(void *dst, const UA_DataType *type) {
     UA_StatusCode retval = UA_STATUSCODE_GOOD;
     UA_Byte membersSize = type->membersSize;
     const UA_DataType *typelists[2] = { UA_TYPES, &type[-type->typeIndex] };
-    for(size_t i = 0; i < membersSize; ++i) {
+    for(size_t i = 0; i < membersSize && retval == UA_STATUSCODE_GOOD; ++i) {
         const UA_DataTypeMember *member = &type->members[i];
         const UA_DataType *membertype = &typelists[!member->namespaceZero][member->memberTypeIndex];
         if(!member->isArray) {