Skip to content

Commit

Permalink
[Common] Fix use-after-free in LISTP_FOR_EACH_ENTRY_SAFE
Browse files Browse the repository at this point in the history
If we iterate over the list, deleting all elements, after the last
iteration TMP is going to point to an already-freed element. Because of
that, we're not allowed to dereference it after the last iteration.

Signed-off-by: Paweł Marczewski <pawel@invisiblethingslab.com>
  • Loading branch information
pwmarcz committed Sep 10, 2021
1 parent d2645b4 commit b8c121c
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions common/include/list.h
Original file line number Diff line number Diff line change
Expand Up @@ -272,8 +272,8 @@
(HEAD)->first && \
(first_iter || (CURSOR) != (HEAD)->first); \
/* Handle the case where the first element was removed. */ \
first_iter = first_iter && (TMP) != (CURSOR) && (HEAD)->first == (TMP), (CURSOR) = (TMP), \
(TMP) = (TMP)->FIELD.next)
first_iter = first_iter && (TMP) != (CURSOR) && (HEAD)->first == (TMP), \
((TMP) != (CURSOR) && ((CURSOR) = (TMP), (TMP) = (TMP)->FIELD.next)))

/* Continue safe iteration with CURSOR->next */
#define LISTP_FOR_EACH_ENTRY_SAFE_CONTINUE(CURSOR, TMP, HEAD, FIELD) \
Expand Down

0 comments on commit b8c121c

Please sign in to comment.