Skip to content

Commit

Permalink
campaignd: Clear [feedback] from campaign list response *after* using it
Browse files Browse the repository at this point in the history
Fixes an attempt to dereference a destroyed config object, causing
undefined behavior.
  • Loading branch information
irydacea committed Oct 12, 2014
1 parent 43b572d commit 97690a2
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions src/campaign_server/campaign_server.cpp
Expand Up @@ -421,11 +421,12 @@ void server::handle_request_campaign_list(const server::request& req)
// Build a feedback_url string attribute from the
// internal [feedback] data.
const config& url_params = j.child_or_empty("feedback");
j.clear_children("feedback");

if(!url_params.empty() && !feedback_url_format_.empty()) {
j["feedback_url"] = format_addon_feedback_url(feedback_url_format_, url_params);
}

// Clients don't need to see the original data, so discard it.
j.clear_children("feedback");
}

config response;
Expand Down

0 comments on commit 97690a2

Please sign in to comment.