Permalink
Browse files

SERVER-5081 do not delete iterator until after it's incremented

Avoids memory reads of freed memory.
  • Loading branch information...
1 parent d13fb74 commit abb62840567ae8e342fcd07c845765f7fca9e7a8 @milkie milkie committed with erh Feb 29, 2012
Showing with 6 additions and 3 deletions.
  1. +6 −3 db/repl/rs.cpp
View
@@ -100,17 +100,20 @@ namespace mongo {
lock lk(this);
Member *max = 0;
-
- for (set<unsigned>::iterator it = _electableSet.begin(); it != _electableSet.end(); it++) {
+ set<unsigned>::iterator it = _electableSet.begin();
+ while ( it != _electableSet.end() ) {
const Member *temp = findById(*it);
if (!temp) {
log() << "couldn't find member: " << *it << endl;
- _electableSet.erase(*it);
+ set<unsigned>::iterator it_delete = it;
+ it++;
+ _electableSet.erase(it_delete);
continue;
}
if (!max || max->config().priority < temp->config().priority) {
max = (Member*)temp;
}
+ it++;
}
return max;

0 comments on commit abb6284

Please sign in to comment.