billiob pushed a commit to branch master.
http://git.enlightenment.org/apps/terminology.git/commit/?id=e55fd612084df03e894d080e1948a104af67a214
commit e55fd612084df03e894d080e1948a104af67a214
Author: Benjamin Jacobs <b...@spam.thsi.be>
Date: Thu Apr 5 22:28:27 2018 +0200
popmedia: NULL dereferencing prevented in error path.
Summary:
If the execution of _popmedia flows in the goto error path, then the
term pointer member might not assigned and reference counted. However
_ty_http_head_delete and term_unref unconditionaly deference it, resulting
in a NULL access.
This patch add guards to prevent the dereference of the term pointer
in _ty_http_head_delete.
Reviewers: billiob
Reviewed By: billiob
Subscribers: billiob
Differential Revision: https://phab.enlightenment.org/D5865
---
src/bin/win.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/bin/win.c b/src/bin/win.c
index a4d4579..0564865 100644
--- a/src/bin/win.c
+++ b/src/bin/win.c
@@ -4052,8 +4052,11 @@ _ty_http_head_delete(Ty_Http_Head *ty_head)
eina_stringshare_del(ty_head->src);
ecore_con_url_free(ty_head->url);
ecore_event_handler_del(ty_head->url_complete);
- edje_object_signal_emit(ty_head->term->bg, "done", "terminology");
- term_unref(ty_head->term);
+ if (ty_head->term)
+ {
+ edje_object_signal_emit(ty_head->term->bg, "done", "terminology");
+ term_unref(ty_head->term);
+ }
ecore_timer_del(ty_head->timeout);
free(ty_head);
--
