From: youngman <yman.jung@samsung.com>
Date: Fri, 12 Aug 2016 07:20:33 +0000 (+0900)
Subject: (double free) crash occurred when discovering device
X-Git-Tag: accepted/tizen/mobile/20160819.063434
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Ftags%2Faccepted%2Ftizen%2Fmobile%2F20160819.063434;p=platform%2Fupstream%2Fiotivity.git

(double free) crash occurred when discovering device

Change-Id: I5ae6cbe8e62e5b0aeb0dd34a5d239cc7761b2ea9
Signed-off-by: youngman <yman.jung@samsung.com>
Reviewed-on: https://gerrit.iotivity.org/gerrit/10331
Tested-by: jenkins-iotivity <jenkins-iotivity@opendaylight.org>
Reviewed-by: Youngjae Shin <yj99.shin@samsung.com>
Reviewed-by: Randeep Singh <randeep.s@samsung.com>
---

diff --git a/resource/csdk/security/provisioning/include/pmutility.h b/resource/csdk/security/provisioning/include/pmutility.h
index c36b204..2a64248 100644
--- a/resource/csdk/security/provisioning/include/pmutility.h
+++ b/resource/csdk/security/provisioning/include/pmutility.h
@@ -109,7 +109,7 @@ void PMPrintOCProvisionDev(const OCProvisionDev_t* pDev);
  * @return true when deletion is happened, false when no deletion is occured. In case either of
  * two arguments is null it will return false.
  */
-bool PMDeleteFromUUIDList(OCUuidList_t *pUuidList, OicUuid_t *targetId);
+bool PMDeleteFromUUIDList(OCUuidList_t **pUuidList, OicUuid_t *targetId);
 
 #ifdef __cplusplus
 }
diff --git a/resource/csdk/security/provisioning/src/ocprovisioningmanager.c b/resource/csdk/security/provisioning/src/ocprovisioningmanager.c
index 1fb9388..34d3a1f 100644
--- a/resource/csdk/security/provisioning/src/ocprovisioningmanager.c
+++ b/resource/csdk/security/provisioning/src/ocprovisioningmanager.c
@@ -891,7 +891,7 @@ OCStackResult OCGetDevInfoFromNetwork(unsigned short waittime,
     size_t deleteCnt = 0;
     while (pCurDev)
     {
-        if(true == PMDeleteFromUUIDList(uuidList, &pCurDev->doxm->deviceID))
+        if(true == PMDeleteFromUUIDList(&uuidList, &pCurDev->doxm->deviceID))
         {
             deleteCnt++;
         }
diff --git a/resource/csdk/security/provisioning/src/pmutility.c b/resource/csdk/security/provisioning/src/pmutility.c
index 56bf9b2..47f1c3f 100644
--- a/resource/csdk/security/provisioning/src/pmutility.c
+++ b/resource/csdk/security/provisioning/src/pmutility.c
@@ -943,18 +943,18 @@ void PMPrintOCProvisionDev(const OCProvisionDev_t* pDev)
     }
 }
 
-bool PMDeleteFromUUIDList(OCUuidList_t *pUuidList, OicUuid_t *targetId)
+bool PMDeleteFromUUIDList(OCUuidList_t **pUuidList, OicUuid_t *targetId)
 {
-    if(pUuidList == NULL || targetId == NULL)
+    if(*pUuidList == NULL || targetId == NULL)
     {
         return false;
     }
     OCUuidList_t *tmp1 = NULL,*tmp2=NULL;
-    LL_FOREACH_SAFE(pUuidList, tmp1, tmp2)
+    LL_FOREACH_SAFE(*pUuidList, tmp1, tmp2)
     {
         if(0 == memcmp(tmp1->dev.id, targetId->id, sizeof(targetId->id)))
         {
-            LL_DELETE(pUuidList, tmp1);
+            LL_DELETE(*pUuidList, tmp1);
             OICFree(tmp1);
             return true;
         }