[Scummvm-git-logs] scummvm master -> 49b83925a00aed9f4283c42013260d4e3bbb9a5a

[sev-]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
49b83925a0 SCUMM HE: Fix double free


Commit: 49b83925a00aed9f4283c42013260d4e3bbb9a5a
    https://github.com/scummvm/scummvm/commit/49b83925a00aed9f4283c42013260d4e3bbb9a5a
Author: Eugene Sandulenko (sev at scummvm.org)
Date: 2019-10-25T00:16:37+02:00

Commit Message:
SCUMM HE: Fix double free

Changed paths:
    engines/scumm/he/moonbase/net_main.cpp


diff --git a/engines/scumm/he/moonbase/net_main.cpp b/engines/scumm/he/moonbase/net_main.cpp
index 0c40502..4b3fce4 100644
--- a/engines/scumm/he/moonbase/net_main.cpp
+++ b/engines/scumm/he/moonbase/net_main.cpp
@@ -76,8 +76,9 @@ int Net::addUser(char *shortName, char *longName) {
 		new Common::Callback<Net, Common::JSONValue *>(this, &Net::addUserCallback),
 		new Common::Callback<Net, Networking::ErrorResponse>(this, &Net::addUserErrorCallback));
 
-	snprintf((char *)_tmpbuffer, MAX_PACKET_SIZE, "{\"shortname\":\"%s\",\"longname\":\"%s\",\"sessionid\":%d}", shortName, longName, _sessionid);
-	rq.setPostData(_tmpbuffer, strlen((char *)_tmpbuffer));
+	char *buf = (char *)malloc(MAX_PACKET_SIZE);
+	snprintf(buf, MAX_PACKET_SIZE, "{\"shortname\":\"%s\",\"longname\":\"%s\",\"sessionid\":%d}", shortName, longName, _sessionid);
+	rq.setPostData((byte *)buf, strlen(buf));
 	rq.setContentType("application/json");
 
 	rq.start();
@@ -129,8 +130,9 @@ int Net::createSession(char *name) {
 		new Common::Callback<Net, Common::JSONValue *>(this, &Net::createSessionCallback),
 		new Common::Callback<Net, Networking::ErrorResponse>(this, &Net::createSessionErrorCallback));
 
-	snprintf((char *)_tmpbuffer, MAX_PACKET_SIZE, "{\"name\":\"%s\"}", name);
-	rq.setPostData(_tmpbuffer, strlen((char *)_tmpbuffer));
+	char *buf = (char *)malloc(MAX_PACKET_SIZE);
+	snprintf(buf, MAX_PACKET_SIZE, "{\"name\":\"%s\"}", name);
+	rq.setPostData((byte *)buf, strlen(buf));
 	rq.setContentType("application/json");
 
 	rq.start();