From: Jaroslav Kysela <perex@perex.cz>
Date: Mon, 20 Jun 2016 08:12:02 +0000 (+0200)
Subject: htsp server: fix memory leak in htsmsg_binary_deserialize() - free(buf)
X-Git-Tag: v4.2.1~417
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d3251df665e832bb7ead79ee80db3652d802309f;p=thirdparty%2Ftvheadend.git

htsp server: fix memory leak in htsmsg_binary_deserialize() - free(buf)
---

diff --git a/src/htsmsg_binary.c b/src/htsmsg_binary.c
index ef5cbf650..1755f2dd2 100644
--- a/src/htsmsg_binary.c
+++ b/src/htsmsg_binary.c
@@ -147,6 +147,7 @@ htsmsg_binary_deserialize(void *data, size_t len, const void *buf)
   htsmsg_t *msg = htsmsg_create_map();
   int r = htsmsg_binary_des0(msg, data, len);
   if (r < 0) {
+    free(buf);
     htsmsg_destroy(msg);
     return NULL;
   }
@@ -156,6 +157,8 @@ htsmsg_binary_deserialize(void *data, size_t len, const void *buf)
 #if ENABLE_SLOW_MEMORYINFO
     memoryinfo_append(&htsmsg_memoryinfo, len);
 #endif
+  } else {
+    free(buf);
   }
   return msg;
 }
diff --git a/src/htsp_server.c b/src/htsp_server.c
index b511a8eb3..8b3e4eaab 100644
--- a/src/htsp_server.c
+++ b/src/htsp_server.c
@@ -2983,7 +2983,7 @@ htsp_read_message(htsp_connection_t *htsp, htsmsg_t **mp, int timeout)
   void *buf;
 
   v = timeout ? tcp_read_timeout(htsp->htsp_fd, data, 4, timeout) : 
-    tcp_read(htsp->htsp_fd, data, 4);
+                tcp_read(htsp->htsp_fd, data, 4);
 
   if(v != 0)
     return v;
@@ -2995,17 +2995,15 @@ htsp_read_message(htsp_connection_t *htsp, htsmsg_t **mp, int timeout)
     return ENOMEM;
 
   v = timeout ? tcp_read_timeout(htsp->htsp_fd, buf, len, timeout) : 
-    tcp_read(htsp->htsp_fd, buf, len);
+                tcp_read(htsp->htsp_fd, buf, len);
   
   if(v != 0) {
     free(buf);
     return v;
   }
 
-  /* buf will be tied to the message.
-   * NB: If the message can not be deserialized buf will be free'd by the
-   * function.
-   */
+  /* buf will be tied to the message (on success) */
+  /* bellow fcn calls free(buf) (on failure) */
   *mp = htsmsg_binary_deserialize(buf, len, buf);
   if(*mp == NULL)
     return EBADMSG;