Opened 16 years ago

Closed 16 years ago

#5294 closed defect (fixed)

XMLParseBase::ParseUIType might use uitype after it has been deleted

Reported by: Erik Hovland <erik@…> Owned by: stuartm
Priority: minor Milestone: 0.22
Component: mythtv Version: head
Severity: low Keywords:
Cc: Ticket locked: no

Description

ParseUIType() can delete uitype and then potentially use uitype. Which when dereferenced will cause a segfault.

Attachments (1)

libs_libmythui_xmlparsebase.cpp-use-after-free.patch​ (735 bytes) - added by Erik Hovland <erik@…> 16 years ago.

Download all attachments as: .zip

Change History (3)

Changed 16 years ago by Erik Hovland <erik@…>

Attachment: libs_libmythui_xmlparsebase.cpp-use-after-free.patch​ added

comment:1 Changed 16 years ago by stuartm

Milestone: unknown → 0.22
Owner: changed from Isaac Richards to stuartm
Status: new → assigned

comment:2 Changed 16 years ago by danielk

Resolution: → fixed
Status: assigned → closed

(In [17635]) Fixes #5294. A 'return NULL' was missing in the handling of one of the fatal error conditions; caused a deleted pointer to be dereferenced.

Note: See TracTickets for help on using tickets.