tree-wide: fix uaf bugs

1 files changed, 16 insertions, 17 deletions

diff --git a/src/process_url.c b/src/process_url.c
index 843fedf..e09647a 100644
--- a/src/process_url.c
+++ b/src/process_url.c
@@ -145,7 +145,7 @@ static void gen_fullpathfn(char *fullpathfn, const char *outdir,
           outdir[strlen(outdir) - 1] == SPLITTER_CHAR ? "" : SPLITTER_STR, fn);
 }
 
-static int parse_url(const char *URL, const char *outdir, char **p_fn) {
+static int parse_url(const char *URL, const char *outdir, char *fn) {
   CURLUcode ue = logerr(curl_url_set(h, CURLUPART_URL, URL, 0));
   if (ue && ue != CURLUE_NO_QUERY) {
     return 1;
@@ -205,7 +205,7 @@ static int parse_url(const char *URL, const char *outdir, char **p_fn) {
 
   /* filename */
 
-  if (p_fn == NULL) {
+  if (!fn) {
     const char *patterns_str[1] = {"(?:.+\\/)([^#/?]+)"};
     str_array_t results = create_str_array(0);
     const str_array_t patterns = {(char **)patterns_str, 1};
@@ -229,9 +229,9 @@ static int parse_url(const char *URL, const char *outdir, char **p_fn) {
       return 1;
     }
   } else {
-    curl_c->outfn = malloc(strlen(outdir) + strlen(*p_fn) + 2);
-    gen_fullpathfn(curl_c->outfn, outdir, *p_fn);
-    free_and_nullify((void **)p_fn);
+    curl_c->outfn = malloc(strlen(outdir) + strlen(fn) + 2);
+    gen_fullpathfn(curl_c->outfn, outdir, fn);
+    free_and_nullify(fn);
   }
   DEBUG_PRINT("File will be saved as: %s\n", curl_c->outfn);
   DEBUG_PRINT("Got regular URL: %s\n", curl_c->URL);
@@ -349,8 +349,7 @@ static int pull_part(void *a) {
   return (int)res;
 }
 
-static int merge_and_cleanup(curl_conf_t **p_curl_c) {
-  curl_conf_t *curl_c = *p_curl_c;
+static int merge_and_cleanup(curl_conf_t *curl_c) {
   if (corrupted) {
     append_log("Cancelling...\n");
   } else {
@@ -390,9 +389,9 @@ static int merge_and_cleanup(curl_conf_t **p_curl_c) {
   // Reset stat
   curl_c->success_thrd = 0;
   curl_c->total_thrd = 0;
-  free_and_nullify((void **)&curl_c->URL);
-  free_and_nullify((void **)&curl_c->outfn);
-  free_and_nullify((void **)p_curl_c);
+  free_and_nullify(curl_c->URL);
+  free_and_nullify(curl_c->outfn);
+  free_and_nullify(curl_c);
 
   return 0;
 }
@@ -461,7 +460,7 @@ static char *callback_struct_convert_fullpath(char **p_filename) {
   char *tmp = malloc(strlen(outdir_g) + strlen(*p_filename) + 2);
   replace_illegal_char(*p_filename);
   gen_fullpathfn(tmp, outdir_g, *p_filename);
-  free_and_nullify((void **)p_filename);
+  free_and_nullify(*p_filename);
   return tmp;
 }
 
@@ -470,7 +469,7 @@ void add_cookie(char **p_cookie) {
   if (cookie_g) {
     char *tmp = malloc(strlen(cookie_g) + strlen(cookie) + 3);
     sprintf(tmp, "%s; %s", cookie_g, cookie);
-    free_and_nullify((void **)&cookie_g);
+    free_and_nullify(cookie_g);
     cookie_g = tmp;
   } else {
     cookie_g = cookie;
@@ -501,13 +500,13 @@ void curl_cleanup(status_t *stat) {
     }
     mtx_unlock(&mtx);
     if (!stat->is_done) {
-      merge_and_cleanup(&curl_conf);
+      merge_and_cleanup(curl_conf);
     }
     mtx_destroy(&mtx);
     cnd_destroy(&cnd);
   }
   free_queue(&dl_queue);
-  free_and_nullify((void **)&cookie_g);
+  free_and_nullify(cookie_g);
   curl_url_cleanup(h);
   curl_global_cleanup();
 }
@@ -542,7 +541,7 @@ void poll_status(status_t *stat) {
         int r;
         thrd_join(tid[i], &r);
       }
-      merge_and_cleanup(&curl_conf);
+      merge_and_cleanup(curl_conf);
       // Perform the callback
       if (is_empty_queue(&dl_queue) && callback_g && !corrupted) {
         thrd_t cb_thrd;
@@ -567,7 +566,7 @@ int get(const char *URL, char **pdstr) {
   CURLcode res = logerr(curl_easy_perform(curl));
   *pdstr = malloc(pagedata.len + 1);
   strcpy(*pdstr, pagedata.string);
-  free_and_nullify((void **)&pagedata.string);
+  free_and_nullify(pagedata.string);
   curl_easy_cleanup(curl);
   return res;
 }
@@ -605,7 +604,7 @@ void add_url(const char *URL, const char *outdir, const char *fn,
   }
 
   // Pass our cache (outdir_g) to parse_url()
-  if (parse_url(URL, outdir_g, &filename)) {
+  if (parse_url(URL, outdir_g, filename)) {
     DEBUG_PRINT("parse_url() failed with error.\n");
     return; // Parse failed, quit the task directly
   };