Copy xml buffer to malloced buffer to prevent free / xmlFree mixing.

1 files changed, 9 insertions, 2 deletions

diff --git a/src/xplist.c b/src/xplist.c
index 8b6a632..f9289b0 100644
--- a/src/xplist.c
+++ b/src/xplist.c
@@ -373,9 +373,16 @@ void plist_to_xml(plist_t plist, char **plist_xml, uint32_t * length)
 
     node_to_xml(plist, &root);
 
-    xmlDocDumpMemory(plist_doc, (xmlChar **) plist_xml, &size);
-    if (size >= 0)
+    xmlChar* tmp = NULL;
+    xmlDocDumpMemory(plist_doc, &tmp, &size);
+    if (size >= 0 && tmp)
+    {
+        *plist_xml = (char*)malloc(size * sizeof(char));
+        memcpy(*plist_xml, tmp, size);
         *length = size;
+        xmlFree(tmp);
+        tmp = NULL;
+    }
     xmlFreeDoc(plist_doc);
 }