sdp: Fix memory issues to avoid potential crash

NULL pointer check added to handle memory allocation
failure scenarios.

1 files changed, 15 insertions, 1 deletions

diff --git a/src/sdp-xml.c b/src/sdp-xml.c
index 64927813a..a9c472350 100644
--- a/src/sdp-xml.c
+++ b/src/sdp-xml.c
@@ -91,6 +91,10 @@ static struct sdp_xml_data *sdp_xml_data_alloc(void)
 	/* Null terminate the text */
 	elem->size = DEFAULT_XML_DATA_SIZE;
 	elem->text = malloc(DEFAULT_XML_DATA_SIZE);
+	if (!elem->text) {
+		free(elem);
+		return NULL;
+	}
 	elem->text[0] = '\0';
 
 	return elem;
@@ -333,6 +337,8 @@ static char *sdp_xml_parse_string_decode(const char *data, char encoding,
 		int i;
 
 		decoded = malloc((len >> 1) + 1);
+		if (!decoded)
+			return NULL;
 
 		/* Ensure the string is a power of 2 */
 		len = (len >> 1) << 1;
@@ -823,7 +829,7 @@ static void convert_raw_data_to_xml(sdp_data_t *value, int indent_level,
 	{
 		int num_chars_to_escape = 0;
 		int length = value->unitSize - 1;
-		char *strBuf = 0;
+		char *strBuf;
 
 		hex = 0;
 
@@ -850,6 +856,10 @@ static void convert_raw_data_to_xml(sdp_data_t *value, int indent_level,
 			appender(data, "encoding=\"hex\" ");
 			strBuf = malloc(sizeof(char)
 						 * ((value->unitSize-1) * 2 + 1));
+			if (!strBuf) {
+				DBG("No memory to convert raw data to xml");
+				return;
+			}
 
 			/* Unit Size seems to include the size for dtd
 			   It is thus off by 1
@@ -866,6 +876,10 @@ static void convert_raw_data_to_xml(sdp_data_t *value, int indent_level,
 			/* escape the XML disallowed chars */
 			strBuf = malloc(sizeof(char) *
 					(value->unitSize + 1 + num_chars_to_escape * 4));
+			if (!strBuf) {
+				DBG("No memory to convert raw data to xml");
+				return;
+			}
 			for (i = 0, j = 0; i < length; i++) {
 				if (value->val.str[i] == '&') {
 					strBuf[j++] = '&';