summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorGravatar Nikias Bassen2016-12-21 22:56:13 +0100
committerGravatar Nikias Bassen2016-12-21 22:56:13 +0100
commit19b79a93f5e45df7901091e9af6f2a6a6189c65b (patch)
tree9e3398e2df4d30625637f4f42f6cf0e084a19574 /src
parentd98ef4146e4e796e267284f37e06c86e75fcf30f (diff)
downloadlibplist-19b79a93f5e45df7901091e9af6f2a6a6189c65b.tar.gz
libplist-19b79a93f5e45df7901091e9af6f2a6a6189c65b.tar.bz2
xplist: Fix UaF in code checking for closing tag
Diffstat (limited to 'src')
-rw-r--r--src/xplist.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/xplist.c b/src/xplist.c
index ec75226..68fd3ab 100644
--- a/src/xplist.c
+++ b/src/xplist.c
@@ -1135,7 +1135,6 @@ static void node_from_xml(parse_ctx ctx, plist_t *plist, uint32_t depth)
free(keyname);
return;
}
- free(tag);
if (subnode && !closing_tag) {
/* parse sub nodes for structured types */
if (data->type == PLIST_DICT || data->type == PLIST_ARRAY) {
@@ -1144,6 +1143,7 @@ static void node_from_xml(parse_ctx ctx, plist_t *plist, uint32_t depth)
node_from_xml(ctx, &subnode, depth+1);
if (ctx->err) {
/* make sure to bail out if parsing failed */
+ free(tag);
free(keyname);
return;
}
@@ -1212,8 +1212,8 @@ static void node_from_xml(parse_ctx ctx, plist_t *plist, uint32_t depth)
ctx->err++;
break;
}
- break;
}
+ free(tag);
free(keyname);
keyname = NULL;
plist_free(subnode);