Browse Source

text_renderer/svg: fix uaf at template load

If token is not found in svg template, psz_template is
freed. Yet it is used in svg_GetDocument as
psz_file_template and incorectly being double freed in
Destroy().

Since the only use of psz_file_template is in svg_GetDocument
and it is performed after a null-check, setting psz_template
to null after freed should fix the issue.

Fixes: #29370 (Coverity 1398436)
pull/188/head
Khalid Masum 10 months ago
committed by Steve Lhomme
parent
commit
03e511aea8
  1. 1
      modules/text_renderer/svg.c

1
modules/text_renderer/svg.c

@ -127,6 +127,7 @@ static void svg_LoadTemplate( filter_t *p_filter )
{
msg_Err( p_filter, "'%s' not found in SVG template", SVG_TEMPLATE_BODY_TOKEN );
free( psz_template );
psz_template = NULL;
}
else *((char*)p_sys->psz_token) = 0;
}

Loading…
Cancel
Save