Bug #3029
Double free in case of an error during epg_grab
Start date:
2015-07-26
Due date:
% Done:
100%
Estimated time:
Found in version:
4.1-360~g0916e52
Affected Versions:
Description
In case of an error during execution (outlen == 0) the arguments of spawn_and_give_stdout are double freed (resulting in tvheadend to crash)
Following patch fixes it:
diff --git a/src/epggrab/module.c b/src/epggrab/module.c index 5b25816..a806c29 --- a/src/epggrab/module.c +++ b/src/epggrab/module.c @@ -302,8 +302,6 @@ char *epggrab_module_grab_spawn ( void *m ) /* Grab */ outlen = spawn_and_give_stdout(argv[0], (char **)argv, NULL, &rd, NULL, 1); - spawn_free_args(argv); - if (outlen < 0) goto error; @@ -311,6 +309,7 @@ char *epggrab_module_grab_spawn ( void *m ) if (outlen < 1) goto error; + spawn_free_args(argv); close(rd); return outbuf;
History
Updated by Jaroslav Kysela over 9 years ago
- Status changed from New to Fixed
- % Done changed from 0 to 100
Applied in changeset commit:tvheadend|d9cf931f9f7242f070ae990c4765cbdd5276fd66.