[[ Bug 15848 ]] Fix overrelease bug in revXML

livecodeali · livecodeali · commit 033a2ce15791 · 2015-09-02T12:33:02.000+01:00
diff --git a/docs/notes/bugfix-15848.md b/docs/notes/bugfix-15848.md
@@ -0,0 +1 @@
+# Crash on repeating revXMLMatchingNode twice on the same tree
diff --git a/revxml/src/xmlelement.cpp b/revxml/src/xmlelement.cpp
@@ -831,7 +831,8 @@ char *CXMLElement::GetAttributeValue(char *attname, Bool isbuffered)
 			do 
 			{
 				if (!attname || util_strnicmp(tattribute.GetName(), attname, strlen(attname)) == 0)
-					return tattribute.GetContent();
+                // AL-2015-09-02: [[ Bug 15848 ]] if isbuffered is true, returned string is freed by the caller
+					return strdup(tattribute.GetContent());
 			} while (tattribute.GoNext());
 		}
 	}

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+# Crash on repeating revXMLMatchingNode twice on the same tree`
Original file line number	Diff line number	Diff line change
`@@ -831,7 +831,8 @@ char CXMLElement::GetAttributeValue(char attname, Bool isbuffered)`
`831`	`831`	`do`
`832`	`832`	`{`
`833`	`833`	`if (!attname \|\| util_strnicmp(tattribute.GetName(), attname, strlen(attname)) == 0)`
`834`		`- return tattribute.GetContent();`
	`834`	`+ // AL-2015-09-02: [[ Bug 15848 ]] if isbuffered is true, returned string is freed by the caller`
	`835`	`+ return strdup(tattribute.GetContent());`
`835`	`836`	`} while (tattribute.GoNext());`
`836`	`837`	`}`
`837`	`838`	`}`