libs/newlib-cygwin
libs
/
newlib-cygwin
mirror of git://sourceware.org/git/newlib-cygwin.git
4
0
Fork 0
Code Issues Projects Releases Wiki Activity

* flock.cc (delete_lock_in_parent): Use LIST_FOREACH_SAFE to avoid 

dereferencing freed pointer (CID 60224).
This commit is contained in:
Corinna Vinschen 2014-05-20 14:54:06 +00:00
parent f027b7883c
commit 59ce289027
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
winsup/cygwin/ChangeLog
View File

@ -1,3 +1,8 @@
2014-05-20 Corinna Vinschen <corinna@vinschen.de>
* flock.cc (delete_lock_in_parent): Use LIST_FOREACH_SAFE to avoid
dereferencing freed pointer (CID 60224).
2014-05-20 Corinna Vinschen <corinna@vinschen.de> 2014-05-20 Corinna Vinschen <corinna@vinschen.de>
* fhandler_procsysvipc.cc (format_procsysvipc_msg): Rearrange code to * fhandler_procsysvipc.cc (format_procsysvipc_msg): Rearrange code to

6
winsup/cygwin/flock.cc
View File

@ -1,6 +1,6 @@
/* flock.cc. NT specific implementation of advisory file locking. /* flock.cc. NT specific implementation of advisory file locking.
Copyright 2003, 2008, 2009, 2010, 2011, 2012, 2013 Red Hat, Inc. Copyright 2003, 2008, 2009, 2010, 2011, 2012, 2013, 2014 Red Hat, Inc.
This file is part of Cygwin. This file is part of Cygwin.
@ -724,13 +724,13 @@ err:
DWORD WINAPI DWORD WINAPI
delete_lock_in_parent (PVOID param) delete_lock_in_parent (PVOID param)
{ {
inode_t *node; inode_t *node, *next_node;
lockf_t *lock, **prev; lockf_t *lock, **prev;
/* Scan list of all inodes, and reap stale BSD lock if lf_id matches. /* Scan list of all inodes, and reap stale BSD lock if lf_id matches.
Remove inode if empty. */ Remove inode if empty. */
INODE_LIST_LOCK (); INODE_LIST_LOCK ();
LIST_FOREACH (node, &cygheap->inode_list, i_next) LIST_FOREACH_SAFE (node, &cygheap->inode_list, i_next, next_node)
if (!node->inuse ()) if (!node->inuse ())
{ {
for (prev = &node->i_lockf, lock = *prev; lock; lock = *prev) for (prev = &node->i_lockf, lock = *prev; lock; lock = *prev)