diff options
| author | John Baldwin <jhb@FreeBSD.org> | 2022-10-03 23:10:43 +0000 |
|---|---|---|
| committer | John Baldwin <jhb@FreeBSD.org> | 2022-10-03 23:10:43 +0000 |
| commit | 8f27c9d14a559f33aa7fc3245f841f7ce52fadd5 (patch) | |
| tree | 6d69f877b7c34d0c859c47449d2e4e750e58895e | |
| parent | 7973f26ad6f98e6da3e2bb07a1015270c0d16c43 (diff) | |
| download | src-8f27c9d14a559f33aa7fc3245f841f7ce52fadd5.tar.gz src-8f27c9d14a559f33aa7fc3245f841f7ce52fadd5.zip | |
libiconv VIQR: Fix a use after free.
Use TAILQ_FOREACH_SAFE to walk to list of children mnemonics to free
them instead of TAILQ_FOREACH.
Reviewed by: emaste
Reported by: GCC 12 -Wuse-after-free
Differential Revision: https://reviews.freebsd.org/D36821
| -rw-r--r-- | lib/libiconv_modules/VIQR/citrus_viqr.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/libiconv_modules/VIQR/citrus_viqr.c b/lib/libiconv_modules/VIQR/citrus_viqr.c index 8a81a7d12b01..f40910d8edf3 100644 --- a/lib/libiconv_modules/VIQR/citrus_viqr.c +++ b/lib/libiconv_modules/VIQR/citrus_viqr.c @@ -195,9 +195,9 @@ mnemonic_append_child(mnemonic_t *m, const char *s, static void mnemonic_destroy(mnemonic_t *m) { - mnemonic_t *m0; + mnemonic_t *m0, *n; - TAILQ_FOREACH(m0, &m->child, entry) + TAILQ_FOREACH_SAFE(m0, &m->child, entry, n) mnemonic_destroy(m0); free(m); } |