From e55fd612084df03e894d080e1948a104af67a214 Mon Sep 17 00:00:00 2001 From: Benjamin Jacobs Date: Thu, 5 Apr 2018 22:28:27 +0200 Subject: [PATCH] popmedia: NULL dereferencing prevented in error path. Summary: If the execution of _popmedia flows in the goto error path, then the term pointer member might not assigned and reference counted. However _ty_http_head_delete and term_unref unconditionaly deference it, resulting in a NULL access. This patch add guards to prevent the dereference of the term pointer in _ty_http_head_delete. Reviewers: billiob Reviewed By: billiob Subscribers: billiob Differential Revision: https://phab.enlightenment.org/D5865 --- src/bin/win.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/bin/win.c b/src/bin/win.c index a4d45792..0564865f 100644 --- a/src/bin/win.c +++ b/src/bin/win.c @@ -4052,8 +4052,11 @@ _ty_http_head_delete(Ty_Http_Head *ty_head) eina_stringshare_del(ty_head->src); ecore_con_url_free(ty_head->url); ecore_event_handler_del(ty_head->url_complete); - edje_object_signal_emit(ty_head->term->bg, "done", "terminology"); - term_unref(ty_head->term); + if (ty_head->term) + { + edje_object_signal_emit(ty_head->term->bg, "done", "terminology"); + term_unref(ty_head->term); + } ecore_timer_del(ty_head->timeout); free(ty_head);