Bug in wap_push_ppg.c

"Paul Keogh" <[email protected]>
Newsgroups gmane.comp.mobile.kannel.devel
Message-ID <[email protected]>
In the function

static int transform_message(WAPEvent **e, WAPAddrTuple **tuple, 
                             List *push_headers, int cless_accepted, Octstr **type)

it is possible to invoke the 

    if (!content_transformable(push_headers)) 
        goto no_transform;

branch.

If this happens, then

    octstr_destroy(content.type);
    octstr_destroy(content.charset);

will be invoked on an uninitialised instance of content.
The result will be unpredictable.

Paul Keogh
ANAM Wireless Internet Solutions
http://www.anam.com                     
+353 1 284 7555 (wired)               +353 86 234 6047 (wireless)
Castle Yard, Saint Patrick's Road, Dalkey, County Dublin, Ireland
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.