krb5 commit [krb5-1.19]: Fix use-after-free during krad remote_shutdown()
Greg Hudson <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.cvs |
|---|---|
| Message-ID | <[email protected]> |
https://github.com/krb5/krb5/commit/d8c95fe992fe7e0d9314a28364fc26992f1da628 commit d8c95fe992fe7e0d9314a28364fc26992f1da628 Author: Robbie Harwood <[email protected]> Date: Sat May 29 13:25:59 2021 -0400 Fix use-after-free during krad remote_shutdown() Since elements of the queue can be removed on out-of-memory errors, the correct call is K5_TAILQ_FOREACH_SAFE, not K5_TAILQ_FOREACH. Reported by Coverity. (cherry picked from commit 8c88defb16b34937d5b72b4832c854ce2dbe32d1) ticket: 9015 version_fixed: 1.19.2 src/lib/krad/remote.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c index c96a9b4..a938665 100644 --- a/src/lib/krad/remote.c +++ b/src/lib/krad/remote.c @@ -220,12 +220,12 @@ static void remote_shutdown(krad_remote *rr) { krb5_error_code retval; - request *r; + request *r, *next; remote_disconnect(rr); /* Start timers for all unsent packets. */ - K5_TAILQ_FOREACH(r, &rr->list, list) { + K5_TAILQ_FOREACH_SAFE(r, &rr->list, list, next) { if (r->timer == NULL) { retval = request_start_timer(r, rr->vctx); if (retval != 0)