summaryrefslogtreecommitdiff
path: root/src/libudev
diff options
context:
space:
mode:
authorHarald Hoyer <harald@redhat.com>2013-08-19 15:18:43 +0200
committerAnthony G. Basile <blueness@gentoo.org>2013-09-10 05:53:35 -0400
commit6790927a88fa6e4597a58bbdc08b9fdfdff2286c (patch)
treef85b6ea0f76a841b97f9123f5a965004282bd886 /src/libudev
parent25ed53eb940a4cdd1ad9760cf04480fe9b9f67e9 (diff)
libudev-enumerate.c:udev_enumerate_get_list_entry() fixed possible stale pointer
If a realloc() happens in syspath_add(), the move_later pointer could point to an invalid memory region. Let move_later store the array index, instead of the pointer to the entry.
Diffstat (limited to 'src/libudev')
-rw-r--r--src/libudev/libudev-enumerate.c19
1 files changed, 11 insertions, 8 deletions
diff --git a/src/libudev/libudev-enumerate.c b/src/libudev/libudev-enumerate.c
index 5ccaabdc6c..3e791074f3 100644
--- a/src/libudev/libudev-enumerate.c
+++ b/src/libudev/libudev-enumerate.c
@@ -270,8 +270,9 @@ _public_ struct udev_list_entry *udev_enumerate_get_list_entry(struct udev_enume
return NULL;
if (!udev_enumerate->devices_uptodate) {
unsigned int i;
+ int move_later = -1;
unsigned int max;
- struct syspath *prev = NULL, *move_later = NULL;
+ struct syspath *prev = NULL;
size_t move_later_prefix = 0;
udev_list_cleanup(&udev_enumerate->devices_list);
@@ -303,23 +304,25 @@ _public_ struct udev_list_entry *udev_enumerate_get_list_entry(struct udev_enume
move_later_prefix = devices_delay_later(udev_enumerate->udev, entry->syspath);
if (move_later_prefix > 0) {
- move_later = entry;
+ move_later = i;
continue;
}
}
- if (move_later &&
- !strneq(entry->syspath, move_later->syspath, move_later_prefix)) {
+ if ((move_later >= 0) &&
+ !strneq(entry->syspath, udev_enumerate->devices[move_later].syspath, move_later_prefix)) {
- udev_list_entry_add(&udev_enumerate->devices_list, move_later->syspath, NULL);
- move_later = NULL;
+ udev_list_entry_add(&udev_enumerate->devices_list,
+ udev_enumerate->devices[move_later].syspath, NULL);
+ move_later = -1;
}
udev_list_entry_add(&udev_enumerate->devices_list, entry->syspath, NULL);
}
- if (move_later)
- udev_list_entry_add(&udev_enumerate->devices_list, move_later->syspath, NULL);
+ if (move_later >= 0)
+ udev_list_entry_add(&udev_enumerate->devices_list,
+ udev_enumerate->devices[move_later].syspath, NULL);
/* add and cleanup delayed devices from end of list */
for (i = max; i < udev_enumerate->devices_cur; i++) {