Fix double-free problems reported in forums

src/conf.c

@@ -1510,7 +1510,6 @@ void conf_dispose_array(char **argv) {
     if(!argv)
         return;
 
-
     while(argv[index]) {
         free(argv[index]);
         index++;

src/main.c

@@ -580,7 +580,6 @@ int main(int argc, char *argv[]) {
             DPRINTF(E_LOG,L_MAIN|L_DB|L_SCAN,"Scanned %d songs (was %d) in "
                     "%d seconds\n",song_count,old_song_count,
                     time(NULL)-start_time);
-            conf_dispose_array(mp3_dir_array);
         }
 
         os_wait(MAIN_SLEEP_INTERVAL);

src/memdebug.c

@@ -34,6 +34,11 @@ void *debug_calloc(char *file, int line, size_t count, size_t size);
 char *debug_strdup(char *file, int line, const char *str);
 void debug_dump(void);
 
+
+void *_debug_alloc_nolock(char *file, int line, size_t size);
+DEBUGNODE *_debug_find_ptr(void *ptr);
+void _debug_register_ptr(char *file, int line, void *ptr, size_t size);
+
 /**
  * find a ptr in the node list, assuming the list is already
  * locked.
@@ -54,7 +59,18 @@ DEBUGNODE *_debug_find_ptr(void *ptr) {
     return NULL;
 }
 
-void *_debug_alloc_nolock(char *file, int line, int size) {
+void *_debug_alloc_nolock(char *file, int line, size_t size) {
+    void *ptr;
+
+    ptr = malloc(size);
+    if(!ptr)
+        DPRINTF(E_FATAL,L_MISC,"Malloc failed in _debug_alloc\n");
+
+    _debug_register_ptr(file, line, ptr, size);
+    return ptr;
+}
+
+void _debug_register_ptr(char *file, int line, void *ptr, size_t size) {
     DEBUGNODE *pnew;
 
     pnew = (DEBUGNODE *)malloc(sizeof(DEBUGNODE));
@@ -64,15 +80,16 @@ void *_debug_alloc_nolock(char *file, int line, int size) {
     pnew->file = strdup(file);
     pnew->line = line;
     pnew->size = size;
-    pnew->ptr = malloc(size);
-
-    if(!pnew->ptr)
-        DPRINTF(E_FATAL,L_MISC,"Malloc failed in _debug_alloc\n");
+    pnew->ptr = ptr;
 
     pnew->next = _debug_memlist.next;
     _debug_memlist.next = pnew;
+}
 
-    return pnew->ptr;
+void debug_register(char *file, int line, void *ptr, size_t size) {
+    util_mutex_lock(l_memdebug);
+    _debug_register_ptr(file, line, ptr, size);
+    util_mutex_unlock(l_memdebug);
 }
 
 void *_debug_alloc(char *file, int line, int size) {

src/memdebug.h

@@ -9,6 +9,7 @@
 # define calloc(count,size) debug_calloc(__FILE__,__LINE__,(count),(size))
 # define strdup(str) debug_strdup(__FILE__,__LINE__,(str))
 # define mem_dump() debug_dump()
+# define mem_register(ptr, size) debug_register(__FILE__,__LINE__,(ptr),(size))
 
 extern void debug_free(char *file, int line, void *ptr);
 extern void *debug_malloc(char *file, int line, size_t size);
@@ -16,8 +17,11 @@ extern void *debug_realloc(char *file, int line, void *ptr, size_t size);
 extern void *debug_calloc(char *file, int line, size_t count, size_t size);
 extern void *debug_strdup(char *file, int line, const char *str);
 extern void debug_dump(void);
+extern void debug_register(char *file, int line, void *ptr, size_t size);
+
 #else
-# define mem_dump()
+# define mem_dump();
+# define mem_register(ptr, size);
 #endif
 
 

src/scan-mp3.c

@@ -363,6 +363,9 @@ int scan_mp3_get_mp3tags(char *file, MP3FILE *pmp3) {
                     utf8_text=(char *)id3_ucs4_utf8duplicate(native_text);
                 }
 
+                if(utf8_text)
+                    mem_register(utf8_text,0);
+
                 if(!strcmp(pid3frame->id,"TIT2")) { /* Title */
                     used=1;
                     pmp3->title = utf8_text;
@@ -484,6 +487,9 @@ int scan_mp3_get_mp3tags(char *file, MP3FILE *pmp3) {
             native_text=id3_field_getstring(&pid3frame->fields[2]);
             if(native_text) {
                 utf8_text=(char*)id3_ucs4_utf8duplicate(native_text);
+                if(utf8_text)
+                    mem_register(utf8_text,0);
+
                 if((utf8_text) && (strncasecmp(utf8_text,"iTun",4) != 0)) {
                     /* it's a real comment */
                     if(utf8_text)
@@ -495,6 +501,7 @@ int scan_mp3_get_mp3tags(char *file, MP3FILE *pmp3) {
                             free(pmp3->comment);
                         utf8_text=(char*)id3_ucs4_utf8duplicate(native_text);
                         if(utf8_text) {
+                            mem_register(utf8_text,0);
                             pmp3->comment=utf8_text;
                         }
                     }

src/scan-xml.c

@@ -61,7 +61,7 @@ static char *scan_xml_file; /** < The actual file we are scanning */
 static struct rbtree *scan_xml_db;
 
 #define MAYBECOPY(a) if(mp3.a) pmp3->a = mp3.a
-#define MAYBECOPYSTRING(a) if(mp3.a) { free(pmp3->a); pmp3->a = mp3.a; mp3.a=NULL; }
+#define MAYBECOPYSTRING(a) if(mp3.a) { if(pmp3->a) free(pmp3->a); pmp3->a = mp3.a; mp3.a=NULL; }
 #define MAYBEFREE(a) if((a)) { free((a)); (a)=NULL; }
 
 /** iTunes xml values we are interested in */