* [PATCH] emulator/bthost: Fix use after free in bthost_destroy
@ 2013-12-15 19:55 Szymon Janc
2013-12-16 8:07 ` Johan Hedberg
0 siblings, 1 reply; 2+ messages in thread
From: Szymon Janc @ 2013-12-15 19:55 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Szymon Janc
cmd was dereferenced after free. Use temp pointer for freeing.
---
emulator/bthost.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/emulator/bthost.c b/emulator/bthost.c
index 10e7a05..b05072a 100644
--- a/emulator/bthost.c
+++ b/emulator/bthost.c
@@ -186,13 +186,15 @@ static struct l2conn *btconn_find_l2cap_conn_by_scid(struct btconn *conn,
void bthost_destroy(struct bthost *bthost)
{
- struct cmd *cmd;
-
if (!bthost)
return;
- for (cmd = bthost->cmd_q.tail; cmd != NULL; cmd = cmd->next)
+ while (bthost->cmd_q.tail) {
+ struct cmd *cmd = bthost->cmd_q.tail;
+
+ bthost->cmd_q.tail = cmd->next;
free(cmd);
+ }
while (bthost->conns) {
struct btconn *conn = bthost->conns;
--
1.8.5.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] emulator/bthost: Fix use after free in bthost_destroy
2013-12-15 19:55 [PATCH] emulator/bthost: Fix use after free in bthost_destroy Szymon Janc
@ 2013-12-16 8:07 ` Johan Hedberg
0 siblings, 0 replies; 2+ messages in thread
From: Johan Hedberg @ 2013-12-16 8:07 UTC (permalink / raw)
To: Szymon Janc; +Cc: linux-bluetooth
Hi Szymon,
On Sun, Dec 15, 2013, Szymon Janc wrote:
> cmd was dereferenced after free. Use temp pointer for freeing.
> ---
> emulator/bthost.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
Applied. Thanks.
Johan
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-12-16 8:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-12-15 19:55 [PATCH] emulator/bthost: Fix use after free in bthost_destroy Szymon Janc
2013-12-16 8:07 ` Johan Hedberg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox