use-after-free bug in zone.c

[ChetanAhuja]

See my comments in the code below. Very surprising that this hasn't caused widespread crashes (and hasn't been caught before this).

static inline void clear_chunk_list(msgpack_zone_chunk_list* cl, size_t chunk_size)
{
    msgpack_zone_chunk* c = cl->head;         <============ first value of c is the incoming cl->head
    while(true) {
        msgpack_zone_chunk* n = c->next;
        if(n != NULL) {
            free(c);             //                 <===== original cl->head gets free'd here
            c = n;
        } else {
            break;
        }
    }
    cl->head->next = NULL;  //               <=====  same cl->head pointer is being deref'd here.
    cl->free = chunk_size;
    cl->ptr  = ((char*)cl->head) + sizeof(msgpack_zone_chunk);
}

[redboltz]

I believe that this is the same problem as #32 and it have fixed and merged.

[ChetanAhuja]

Yes it's the same issue. Looks like the pull request for the fix has been merged but hasn't made it into master yet.