From 761f62ca2629dc3998b38a198f6dc8be800d67f8 Mon Sep 17 00:00:00 2001
From: Justin Maggard <jmaggard@netgear.com>
Date: Tue, 25 Jan 2011 22:40:37 +0000
Subject: [PATCH] * Fix a couple potential frees of invalid pointers.

---
 log.c      | 6 +++++-
 upnphttp.c | 8 ++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/log.c b/log.c
index fb9f75f..8f45876 100644
--- a/log.c
+++ b/log.c
@@ -135,7 +135,11 @@ log_err(int level, enum _log_facility facility, char *fname, int lineno, char *f
 	// user log
 	va_start(ap, fmt);
 	//vsnprintf(errbuf, sizeof(errbuf), fmt, ap);
-	vasprintf(&errbuf, fmt, ap);
+	if (vasprintf(&errbuf, fmt, ap) == -1)
+	{
+		va_end(ap);
+		return;
+	}
 	va_end(ap);
 
 	// timestamp
diff --git a/upnphttp.c b/upnphttp.c
index 5446291..ecdb925 100644
--- a/upnphttp.c
+++ b/upnphttp.c
@@ -565,7 +565,7 @@ Send501(struct upnphttp * h)
 static const char *
 findendheaders(const char * s, int len)
 {
-	while(len-->0)
+	while(len-- > 0)
 	{
 		if(s[0]=='\r' && s[1]=='\n' && s[2]=='\r' && s[3]=='\n')
 			return s;
@@ -585,13 +585,9 @@ sendXMLdesc(struct upnphttp * h, char * (f)(int *))
 	{
 		DPRINTF(E_ERROR, L_HTTP, "Failed to generate XML description\n");
 		Send500(h);
-		free(desc);
 		return;
 	}
-	else
-	{
-		BuildResp_upnphttp(h, desc, len);
-	}
+	BuildResp_upnphttp(h, desc, len);
 	SendResp_upnphttp(h);
 	CloseSocket_upnphttp(h);
 	free(desc);