A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 11:11:45 -04:00
Code Issues Projects Releases Packages Wiki Activity

KEYS: Fix use-after-free in assoc_array_gc()

Browse source 
An edit script should be considered inaccessible by a function once it has
called assoc_array_apply_edit() or assoc_array_cancel_edit().

However, assoc_array_gc() is accessing the edit script just after the
gc_complete: label.

Reported-by: Andreea-Cristina Bernat <[email protected]>
Signed-off-by: David Howells <[email protected]>
Reviewed-by: Andreea-Cristina Bernat <[email protected]>
cc: [email protected]
cc: [email protected]
Cc: [email protected]
Signed-off-by: James Morris <[email protected]>
This commit is contained in:
David Howells 2014-09-02 13:52:20 +01:00 • committed by James Morris
commit 27419604f5
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/assoc_array.c
View file

@ -1735,7 +1735,7 @@ ascend_old_tree:
gc_complete:
edit->set[0].to = new_root;
assoc_array_apply_edit(edit);
edit->array->nr_leaves_on_tree = nr_leaves_on_tree;
array->nr_leaves_on_tree = nr_leaves_on_tree;
return 0;
enomem: