htsp server: fix memory leak in htsmsg_binary_deserialize() - free(buf)

tvheadend · Jun 20, 2016 · d3251df · d3251df
1 parent 4e508db
commit d3251df
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 6 deletions.
diff --git a/src/htsmsg_binary.c b/src/htsmsg_binary.c
@@ -147,6 +147,7 @@ htsmsg_binary_deserialize(void *data, size_t len, const void *buf)
   htsmsg_t *msg = htsmsg_create_map();
   int r = htsmsg_binary_des0(msg, data, len);
   if (r < 0) {
+    free(buf);
     htsmsg_destroy(msg);
     return NULL;
   }
@@ -156,6 +157,8 @@ htsmsg_binary_deserialize(void *data, size_t len, const void *buf)
 #if ENABLE_SLOW_MEMORYINFO
     memoryinfo_append(&htsmsg_memoryinfo, len);
 #endif
+  } else {
+    free(buf);
   }
   return msg;
 }

diff --git a/src/htsp_server.c b/src/htsp_server.c
@@ -2983,7 +2983,7 @@ htsp_read_message(htsp_connection_t *htsp, htsmsg_t **mp, int timeout)
   void *buf;
 
   v = timeout ? tcp_read_timeout(htsp->htsp_fd, data, 4, timeout) : 
-    tcp_read(htsp->htsp_fd, data, 4);
+                tcp_read(htsp->htsp_fd, data, 4);
 
   if(v != 0)
     return v;
@@ -2995,17 +2995,15 @@ htsp_read_message(htsp_connection_t *htsp, htsmsg_t **mp, int timeout)
     return ENOMEM;
 
   v = timeout ? tcp_read_timeout(htsp->htsp_fd, buf, len, timeout) : 
-    tcp_read(htsp->htsp_fd, buf, len);
+                tcp_read(htsp->htsp_fd, buf, len);
 
   if(v != 0) {
     free(buf);
     return v;
   }
 
-  /* buf will be tied to the message.
-   * NB: If the message can not be deserialized buf will be free'd by the
-   * function.
-   */
+  /* buf will be tied to the message (on success) */
+  /* bellow fcn calls free(buf) (on failure) */
   *mp = htsmsg_binary_deserialize(buf, len, buf);
   if(*mp == NULL)
     return EBADMSG;