(trunk libT) #3956 "tr_bencFree() could be faster" -- fix memory error.

#3956's r11780 has uncovered a longstanding memory error that occurs when tr_bencParse() fails to parse a dict and leaves a dangling key. This is fixed by cleaning up the key.

diff --git a/libtransmission/bencode.c b/libtransmission/bencode.c
index d3a648436cb71482863ce59f0e5f7777041ec76e..be87bb03136871de07463d93acb77c7a219fcd39 100644 (file)
--- a/libtransmission/bencode.c
+++ b/libtransmission/bencode.c
@@ -944,14 +944,13 @@ struct SaveNode
 static void
 nodeInitDict( struct SaveNode * node, const tr_benc * val, tr_bool sort_dicts )
 {
-    int nKeys;
     const int n = val->val.l.count;
+    const int nKeys = n / 2;
 
     assert( tr_bencIsDict( val ) );
 
-    nKeys = n / 2;
     node->val = val;
-    node->children = tr_new0( int, nKeys * 2 );
+    node->children = tr_new0( int, n );
 
     if( sort_dicts )
     {
@@ -974,7 +973,7 @@ nodeInitDict( struct SaveNode * node, const tr_benc * val, tr_bool sort_dicts )
     }
     else
     {
-        int i ;
+        int i;
 
         for( i=0; i<n; ++i )
             node->children[node->childCount++] = i;