commit 6ef1c269792ece2842f65b4b6966ebac3b21a8e3
author Nikias Bassen <nikias@gmx.li> Fri Jan 28 22:06:02 2022 +0100
committer Nikias Bassen <nikias@gmx.li> Fri Jan 28 22:06:02 2022 +0100
tree 59f9d3ef72c9da0d9abbff3d851a706c1df7d2e1
parent 7e45a2ee6e407d36374eb6c3d5196e768c246115

jplist: Fix use-after-free in unescape_string

Credit to OSS-Fuzz

src/jplist.c

diff --git a/src/jplist.c b/src/jplist.c
index cb29742..ace4bff 100644
--- a/src/jplist.c
+++ b/src/jplist.c
@@ -496,13 +496,13 @@
                 case 'u': {
                     unsigned int val = 0;
                     if (str_len-(i+2) < 4) {
-                        free(strval);
                         PLIST_JSON_ERR("%s: invalid escape sequence '%s' (too short)\n", __func__, strval+i);
+                        free(strval);
                         return NULL;
                     }
                     if (!(isxdigit(strval[i+2]) && isxdigit(strval[i+3]) && isxdigit(strval[i+4]) && isxdigit(strval[i+5])) || sscanf(strval+i+2, "%04x", &val) != 1) {
-                        free(strval);
                         PLIST_JSON_ERR("%s: invalid escape sequence '%.*s'\n", __func__, 6, strval+i);
+                        free(strval);
                         return NULL;
                     }
                     int bytelen = 0;