[vlc-commits] smb: Fix use after free

[Hugo Beauzée-Luyssen]

vlc/vlc-3.0 | branch: master | Hugo Beauzée-Luyssen <hugo at beauzee.fr> | Fri Jan 19 13:38:09 2018 +0100| [8b85798d2e86983d057ee708dec256f06d2c0c85] | committer: Jean-Baptiste Kempf

smb: Fix use after free

CID #1461260

(cherry picked from commit b7e3e1560820864207dbb092f7f66776e29c4843)
Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=8b85798d2e86983d057ee708dec256f06d2c0c85
---

 modules/access/smb.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/access/smb.c b/modules/access/smb.c
index f5b77de3ab..3a299d2c65 100644
--- a/modules/access/smb.c
+++ b/modules/access/smb.c
@@ -436,7 +436,6 @@ static int DirRead (stream_t *p_access, input_item_node_t *p_node )
                     i_ret = VLC_ENOMEM;
                     break;
                 }
-                free( psz_name );
                 // We need to concatenate the scheme before, as the window version
                 // of smb_get_uri generates a path (and the other call site needs
                 // a path). The path is already prefixed by "//" so we just need
@@ -444,6 +443,7 @@ static int DirRead (stream_t *p_access, input_item_node_t *p_node )
                 char* psz_uri;
                 if( asprintf( &psz_uri, "file:%s", psz_path ) < 0 )
                 {
+                    free( psz_name );
                     free( psz_path );
                     i_ret = VLC_ENOMEM;
                     break;
@@ -452,6 +452,7 @@ static int DirRead (stream_t *p_access, input_item_node_t *p_node )
 
                 i_ret = vlc_readdir_helper_additem( &rdh, psz_uri, NULL,
                                     psz_name, ITEM_TYPE_DIRECTORY, ITEM_NET );
+                free( psz_name );
                 free( psz_uri );
             }
         }