krb5 commit [krb5-1.19]: Fix use-after-free during krad remote_shutdown()

Greg Hudson <[email protected]>
Newsgroups gmane.comp.encryption.kerberos.cvs
Message-ID <[email protected]>
https://github.com/krb5/krb5/commit/d8c95fe992fe7e0d9314a28364fc26992f1da628
commit d8c95fe992fe7e0d9314a28364fc26992f1da628
Author: Robbie Harwood <[email protected]>
Date:   Sat May 29 13:25:59 2021 -0400

    Fix use-after-free during krad remote_shutdown()
    
    Since elements of the queue can be removed on out-of-memory errors,
    the correct call is K5_TAILQ_FOREACH_SAFE, not K5_TAILQ_FOREACH.
    Reported by Coverity.
    
    (cherry picked from commit 8c88defb16b34937d5b72b4832c854ce2dbe32d1)
    
    ticket: 9015
    version_fixed: 1.19.2

 src/lib/krad/remote.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
index c96a9b4..a938665 100644
--- a/src/lib/krad/remote.c
+++ b/src/lib/krad/remote.c
@@ -220,12 +220,12 @@ static void
 remote_shutdown(krad_remote *rr)
 {
     krb5_error_code retval;
-    request *r;
+    request *r, *next;
 
     remote_disconnect(rr);
 
     /* Start timers for all unsent packets. */
-    K5_TAILQ_FOREACH(r, &rr->list, list) {
+    K5_TAILQ_FOREACH_SAFE(r, &rr->list, list, next) {
         if (r->timer == NULL) {
             retval = request_start_timer(r, rr->vctx);
             if (retval != 0)
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.