diff options
| author |  Eric Chen | 2018-11-28 18:17:24 +0800 |
|---|---|---|
| committer |  Nikias Bassen | 2018-11-29 00:26:02 +0100 |
| commit | 9a93f8727414c33f9efa5448b468533a347cf519 (patch) | |
| tree | 49465e2306bba281de41784aa8abdd74c6251172 | |
| parent | 1cc8b343a4bc9320758c78e187b13bb3c9029f12 (diff) | |
| download | usbmuxd-9a93f8727414c33f9efa5448b468533a347cf519.tar.gz usbmuxd-9a93f8727414c33f9efa5448b468533a347cf519.tar.bz2 | |
client: Fix Use-after-Free in handling of SavePairRecord message when reading device id
| -rw-r--r-- | src/client.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/client.c b/src/client.c index c566d8c..3472e6e 100644 --- a/src/client.c +++ b/src/client.c @@ -750,7 +750,6 @@ static int client_command(struct mux_client *client, struct usbmuxd_header *hdr) if (rdata && plist_get_node_type(rdata) == PLIST_DATA) { plist_get_data_val(rdata, &record_data, &record_size); } - plist_free(dict); if (record_id && record_data) { res = config_set_device_record(record_id, record_data, record_size); @@ -790,6 +789,7 @@ static int client_command(struct mux_client *client, struct usbmuxd_header *hdr) rval = EINVAL; } free(record_data); + plist_free(dict); if (send_result(client, hdr->tag, rval) < 0) return -1; return 0; |