diff options
| author | Harald Hoyer <harald@redhat.com> | 2013-08-19 15:18:43 +0200 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2013-09-10 05:53:35 -0400 |
| commit | 6790927a88fa6e4597a58bbdc08b9fdfdff2286c (patch) | |
| tree | f85b6ea0f76a841b97f9123f5a965004282bd886 /src/libudev/libudev-enumerate.c | |
| parent | 25ed53eb940a4cdd1ad9760cf04480fe9b9f67e9 (diff) | |
libudev-enumerate.c:udev_enumerate_get_list_entry() fixed possible stale pointer
If a realloc() happens in syspath_add(), the move_later pointer could
point to an invalid memory region.
Let move_later store the array index, instead of the pointer to the
entry.
Diffstat (limited to 'src/libudev/libudev-enumerate.c')
| -rw-r--r-- | src/libudev/libudev-enumerate.c | 19 |
1 files changed, 11 insertions, 8 deletions
diff --git a/src/libudev/libudev-enumerate.c b/src/libudev/libudev-enumerate.c index 5ccaabdc6c..3e791074f3 100644 --- a/src/libudev/libudev-enumerate.c +++ b/src/libudev/libudev-enumerate.c @@ -270,8 +270,9 @@ _public_ struct udev_list_entry *udev_enumerate_get_list_entry(struct udev_enume return NULL; if (!udev_enumerate->devices_uptodate) { unsigned int i; + int move_later = -1; unsigned int max; - struct syspath *prev = NULL, *move_later = NULL; + struct syspath *prev = NULL; size_t move_later_prefix = 0; udev_list_cleanup(&udev_enumerate->devices_list); @@ -303,23 +304,25 @@ _public_ struct udev_list_entry *udev_enumerate_get_list_entry(struct udev_enume move_later_prefix = devices_delay_later(udev_enumerate->udev, entry->syspath); if (move_later_prefix > 0) { - move_later = entry; + move_later = i; continue; } } - if (move_later && - !strneq(entry->syspath, move_later->syspath, move_later_prefix)) { + if ((move_later >= 0) && + !strneq(entry->syspath, udev_enumerate->devices[move_later].syspath, move_later_prefix)) { - udev_list_entry_add(&udev_enumerate->devices_list, move_later->syspath, NULL); - move_later = NULL; + udev_list_entry_add(&udev_enumerate->devices_list, + udev_enumerate->devices[move_later].syspath, NULL); + move_later = -1; } udev_list_entry_add(&udev_enumerate->devices_list, entry->syspath, NULL); } - if (move_later) - udev_list_entry_add(&udev_enumerate->devices_list, move_later->syspath, NULL); + if (move_later >= 0) + udev_list_entry_add(&udev_enumerate->devices_list, + udev_enumerate->devices[move_later].syspath, NULL); /* add and cleanup delayed devices from end of list */ for (i = max; i < udev_enumerate->devices_cur; i++) { |