Opened 12 years ago

Closed 11 years ago

#5294 closed defect (fixed)

XMLParseBase::ParseUIType might use uitype after it has been deleted

Reported by: Erik Hovland <erik@…> Owned by: stuartm
Priority: minor Milestone: 0.22
Component: mythtv Version: head
Severity: low Keywords:
Cc: Ticket locked: no

Description

ParseUIType() can delete uitype and then potentially use uitype. Which when dereferenced will cause a segfault.

Attachments (1)

libs_libmythui_xmlparsebase.cpp-use-after-free.patch (735 bytes) - added by Erik Hovland <erik@…> 12 years ago.

Download all attachments as: .zip

Change History (3)

Changed 12 years ago by Erik Hovland <erik@…>

comment:1 Changed 12 years ago by stuartm

Milestone: unknown0.22
Owner: changed from Isaac Richards to stuartm
Status: newassigned

comment:2 Changed 11 years ago by danielk

Resolution: fixed
Status: assignedclosed

(In [17635]) Fixes #5294. A 'return NULL' was missing in the handling of one of the fatal error conditions; caused a deleted pointer to be dereferenced.

Note: See TracTickets for help on using tickets.