status-im
/
miniupnp
mirror of https://github.com/status-im/miniupnp.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

upnp_event_prepare(): check the return value of snprintf()

This commit is contained in:
Thomas Bernard 2018-12-18 22:37:14 +01:00
parent cd506a67e1
commit bec6ccec63
1 changed files with 26 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
miniupnpd/upnpevents.c
View File

@ -443,19 +443,34 @@ static void upnp_event_prepare(struct upnp_event_notify * obj)
l = 0;
}
obj->buffersize = 1024;
obj->buffer = malloc(obj->buffersize);
if(!obj->buffer) {
syslog(LOG_ERR, "%s: malloc returned NULL", "upnp_event_prepare");
if(xml) {
free(xml);
for (;;) {
obj->buffer = malloc(obj->buffersize);
if(!obj->buffer) {
syslog(LOG_ERR, "%s: malloc returned NULL", "upnp_event_prepare");
if(xml) {
free(xml);
}
obj->state = EError;
return;
}
obj->state = EError;
return;
obj->tosend = snprintf(obj->buffer, obj->buffersize, notifymsg,
obj->path, obj->addrstr, obj->portstr, l+2,
obj->sub->uuid, obj->sub->seq,
l, xml);
if (obj->tosend < 0) {
syslog(LOG_ERR, "%s: snprintf() failed", "upnp_event_prepare");
if(xml) {
free(xml);
}
obj->state = EError;
return;
} else if (obj->tosend < obj->buffersize) {
break; /* the buffer was large enough */
}
/* Try again with a buffer big enough */
free(obj->buffer);
obj->buffersize = obj->tosend + 1; /* reserve space for the final 0 */
}
obj->tosend = snprintf(obj->buffer, obj->buffersize, notifymsg,
obj->path, obj->addrstr, obj->portstr, l+2,
obj->sub->uuid, obj->sub->seq,
l, xml);
if(xml) {
free(xml);
xml = NULL;