diff options
| author | Edward Sheldrake <ejsheldrake@gmail.com> | 2011-08-30 20:56:54 +0100 |
|---|---|---|
| committer | Shaun McCance <shaunm@gnome.org> | 2011-09-05 16:57:33 -0400 |
| commit | 06dc5defbd2abea0b631d696854254fcde3211aa (patch) | |
| tree | 4659fb0604bb6cce4e64c4064067d7f2ac42add9 | |
| parent | efb2d0d6cc5aaf0b08ed06e1d02eab373e46e835 (diff) | |
| download | yelp-06dc5defbd2abea0b631d696854254fcde3211aa.tar.gz | |
Fix crash due to access after free
"next" may point to somewhere inside "url".
| -rw-r--r-- | libyelp/yelp-info-parser.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libyelp/yelp-info-parser.c b/libyelp/yelp-info-parser.c index 5ecdc5a0..e16b6be5 100644 --- a/libyelp/yelp-info-parser.c +++ b/libyelp/yelp-info-parser.c @@ -1416,12 +1416,13 @@ info_process_text_notes (xmlNodePtr *node, gchar *content, GtkTreeStore *tree) /* Massive space. Fix. */ gchar *next = break_point; gchar *url_copy; + gchar *old = url; while (*next == ' ') next++; next--; url_copy = g_strndup (url, break_point-url); - g_free (url); url = g_strconcat (url_copy, next, NULL); + g_free (old); break_point = strchr (url, ' '); g_free (url_copy); } else { |