libcomps icon indicating copy to clipboard operation
libcomps copied to clipboard

possible double-free in comps_doc.c if xmlTextWriter functions fail

Open ret2libc opened this issue 5 years ago • 0 comments

In function comps_doc_xml() in comps_doc.c, the dict object is destroyed at https://github.com/rpm-software-management/libcomps/blob/2ed0fe52d1e7c062a5a42968bb7a7680835914b8/libcomps/src/comps_doc.c#L731 , however there are many other error paths where the object is destroyed again, possibly causing double-free (e.g. https://github.com/rpm-software-management/libcomps/blob/2ed0fe52d1e7c062a5a42968bb7a7680835914b8/libcomps/src/comps_doc.c#L737).

This was probably the result of a wrong copy-paste, where dict should have been replaced with mdict but it wasn't.

ret2libc avatar Jan 21 '19 16:01 ret2libc