From: Jaroslav Kysela <perex@perex.cz>
Date: Tue, 8 Jan 2019 19:26:02 +0000 (+0100)
Subject: avahi: try to fix double free, fixes #5484
X-Git-Tag: v4.2.8~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=efefb315ef0587f5a6852e5c5f22cf435f0409f4;p=thirdparty%2Ftvheadend.git

avahi: try to fix double free, fixes #5484
---

diff --git a/src/avahi.c b/src/avahi.c
index df6e00a68..e91a876c0 100644
--- a/src/avahi.c
+++ b/src/avahi.c
@@ -55,7 +55,7 @@
 #include "config.h"
 
 static AvahiEntryGroup *group = NULL;
-static char *name = NULL;
+static char *name = NULL, *name2 = NULL;
 static AvahiSimplePoll *avahi_asp = NULL;
 static const AvahiPoll *avahi_poll = NULL;
 static int avahi_do_restart = 0;
@@ -83,7 +83,7 @@ entry_group_callback(AvahiEntryGroup *g, AvahiEntryGroupState state,
     /* A service name collision with a remote service
      * happened. Let's pick a new name */
     n = avahi_alternative_service_name(name);
-    avahi_free(name);
+    if (name != name2) avahi_free(name);
     name = n;
     
     tvherror(LS_AVAHI, "Service name collision, renaming service to '%s'", name);
@@ -189,7 +189,7 @@ create_services(AvahiClient *c)
   /* A service name collision with a local service happened. Let's
    * pick a new name */
   n = avahi_alternative_service_name(name);
-  avahi_free(name);
+  if (name != name2) avahi_free(name);
   name = n;
 
   tvherror(LS_AVAHI, "Service name collision, renaming service to '%s'", name);
@@ -257,7 +257,6 @@ static void *
 avahi_thread(void *aux)
 {
   AvahiClient *ac;
-  char *name2;
 
   do {
     if (avahi_poll)
@@ -285,6 +284,7 @@ avahi_thread(void *aux)
 
     name = NULL;
     avahi_free(name2);
+    name2 = NULL;
 
   } while (tvheadend_is_running() && avahi_do_restart);