diff options
| author | Max Kellermann <max@musicpd.org> | 2020-09-23 15:25:25 +0200 |
|---|---|---|
| committer | Max Kellermann <max@musicpd.org> | 2020-09-23 15:25:39 +0200 |
| commit | e9df4116fd3ea01739e6257b7a29adc7018b8c6c (patch) | |
| tree | c97220713fd1dd20363d6cb1d0d830cd201e82fe | |
| parent | 5492304254c86f3a187d728e29afb7d43965c896 (diff) | |
db/upnp: store UPnPDirContent in local variable
Fixes use-after-free because the temporary goes out of scope.
| -rw-r--r-- | src/db/plugins/upnp/UpnpDatabasePlugin.cxx | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/db/plugins/upnp/UpnpDatabasePlugin.cxx b/src/db/plugins/upnp/UpnpDatabasePlugin.cxx index 0c9dc3ed8..f8a80f8c8 100644 --- a/src/db/plugins/upnp/UpnpDatabasePlugin.cxx +++ b/src/db/plugins/upnp/UpnpDatabasePlugin.cxx @@ -346,7 +346,8 @@ UpnpDatabase::SearchSongs(const ContentDirectoryService &server, if (!visit_song) return; - for (auto &dirent : SearchSongs(server, objid, selection).objects) { + const auto content = SearchSongs(server, objid, selection); + for (auto &dirent : content.objects) { if (dirent.type != UPnPDirObject::Type::ITEM || dirent.item_class != UPnPDirObject::ItemClass::MUSIC) continue; @@ -564,7 +565,8 @@ UpnpDatabase::VisitServer(const ContentDirectoryService &server, /* Target was a a container. Visit it. We could read slices and loop here, but it's not useful as mpd will only return data to the client when we're done anyway. */ - for (const auto &dirent : server.readDir(handle, tdirent.id.c_str()).objects) { + const auto contents = server.readDir(handle, tdirent.id.c_str()); + for (const auto &dirent : contents.objects) { const std::string uri = PathTraitsUTF8::Build(base_uri, dirent.name.c_str()); VisitObject(dirent, uri.c_str(), |