upnp.c: Fix heap-use-after-free

If upnp_init() fails, state->impl has already been freed.
paullouisageneau · Jun 15, 2024 · 2f81d47 · 2f81d47
1 parent c111e0a
commit 2f81d47
Showing 1 changed file with 7 additions and 4 deletions.
diff --git a/src/upnp.c b/src/upnp.c
@@ -60,18 +60,21 @@ int upnp_init(protocol_state_t *state) {
 		closesocket(impl->sock);
 
 	free(state->impl);
+	state->impl = NULL;
 	return PROTOCOL_ERR_INSUFF_RESOURCES;
 }
 
 int upnp_cleanup(protocol_state_t *state) {
 	PLUM_LOG_VERBOSE("Cleaning up UPnP state");
 
 	upnp_impl_t *impl = state->impl;
-	closesocket(impl->sock);
-	free(impl->location_url);
-	free(impl->control_url);
+	if (impl) {
+		closesocket(impl->sock);
+		free(impl->location_url);
+		free(impl->control_url);
 
-	free(state->impl);
+		free(state->impl);
+	}
 	return PROTOCOL_ERR_SUCCESS;
 }