update_engine: Fix an invalid memory access in OmahaRequestAction::TransferComplete
The bug only happens when the omaha response is invalid, but still is
very dangerous and could crash the update engine.
BUG=none
TEST=This unittest pass on veyron_minnie
Change-Id: I86f3f802d78815ef09eaa2dd96a288bdf28882a8
Reviewed-on: https://chromium-review.googlesource.com/1164559
Commit-Ready: Amin Hassani <ahassani@chromium.org>
Tested-by: Amin Hassani <ahassani@chromium.org>
Reviewed-by: Sen Jiang <senj@chromium.org>
diff --git a/omaha_request_action.cc b/omaha_request_action.cc
index c9bc269..95dee51 100644
--- a/omaha_request_action.cc
+++ b/omaha_request_action.cc
@@ -1173,13 +1173,13 @@
reinterpret_cast<const char*>(response_buffer_.data()),
response_buffer_.size(),
XML_TRUE);
- XML_ParserFree(parser);
if (res != XML_STATUS_OK || parser_data.failed) {
LOG(ERROR) << "Omaha response not valid XML: "
<< XML_ErrorString(XML_GetErrorCode(parser))
<< " at line " << XML_GetCurrentLineNumber(parser)
<< " col " << XML_GetCurrentColumnNumber(parser);
+ XML_ParserFree(parser);
ErrorCode error_code = ErrorCode::kOmahaRequestXMLParseError;
if (response_buffer_.empty()) {
error_code = ErrorCode::kOmahaRequestEmptyResponseError;
@@ -1189,6 +1189,7 @@
completer.set_code(error_code);
return;
}
+ XML_ParserFree(parser);
// Update the last ping day preferences based on the server daystart response
// even if we didn't send a ping. Omaha always includes the daystart in the