git: 8f27c9d14a55 - main - libiconv VIQR: Fix a use after free.
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 03 Oct 2022 23:11:29 UTC
The branch main has been updated by jhb:
URL: https://cgit.FreeBSD.org/src/commit/?id=8f27c9d14a559f33aa7fc3245f841f7ce52fadd5
commit 8f27c9d14a559f33aa7fc3245f841f7ce52fadd5
Author: John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2022-10-03 23:10:43 +0000
Commit: John Baldwin <jhb@FreeBSD.org>
CommitDate: 2022-10-03 23:10:43 +0000
libiconv VIQR: Fix a use after free.
Use TAILQ_FOREACH_SAFE to walk to list of children mnemonics to free
them instead of TAILQ_FOREACH.
Reviewed by: emaste
Reported by: GCC 12 -Wuse-after-free
Differential Revision: https://reviews.freebsd.org/D36821
---
lib/libiconv_modules/VIQR/citrus_viqr.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/libiconv_modules/VIQR/citrus_viqr.c b/lib/libiconv_modules/VIQR/citrus_viqr.c
index 8a81a7d12b01..f40910d8edf3 100644
--- a/lib/libiconv_modules/VIQR/citrus_viqr.c
+++ b/lib/libiconv_modules/VIQR/citrus_viqr.c
@@ -195,9 +195,9 @@ mnemonic_append_child(mnemonic_t *m, const char *s,
static void
mnemonic_destroy(mnemonic_t *m)
{
- mnemonic_t *m0;
+ mnemonic_t *m0, *n;
- TAILQ_FOREACH(m0, &m->child, entry)
+ TAILQ_FOREACH_SAFE(m0, &m->child, entry, n)
mnemonic_destroy(m0);
free(m);
}