diff options
| author | Timo Teräs <timo.teras@iki.fi> | 2021-01-19 16:10:08 +0200 |
|---|---|---|
| committer | Timo Teräs <timo.teras@iki.fi> | 2021-01-19 16:49:09 +0200 |
| commit | c37b385beefd0e8324bf70f011e52a8c65f7fddf (patch) | |
| tree | 3b25b9b30797caf6e97b82ddd33efcf5b73ae3f7 | |
| parent | b1935a1e79854b332b04916a2829b0c09d1b26c9 (diff) | |
| download | apk-tools-c37b385beefd0e8324bf70f011e52a8c65f7fddf.tar.gz apk-tools-c37b385beefd0e8324bf70f011e52a8c65f7fddf.tar.bz2 apk-tools-c37b385beefd0e8324bf70f011e52a8c65f7fddf.tar.xz apk-tools-c37b385beefd0e8324bf70f011e52a8c65f7fddf.zip | |
libfetch: fix use-after-free in connection cache management
fixes #10734
| -rw-r--r-- | libfetch/common.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libfetch/common.c b/libfetch/common.c index eb54df5..aabe218 100644 --- a/libfetch/common.c +++ b/libfetch/common.c @@ -381,7 +381,7 @@ fetch_cache_get(const struct url *url, int af) void fetch_cache_put(conn_t *conn, int (*closecb)(conn_t *)) { - conn_t *iter, *last; + conn_t *iter, *last, *next_cached; int global_count, host_count; if (conn->cache_url == NULL || cache_global_limit == 0) { @@ -391,8 +391,8 @@ fetch_cache_put(conn_t *conn, int (*closecb)(conn_t *)) global_count = host_count = 0; last = NULL; - for (iter = connection_cache; iter; - last = iter, iter = iter->next_cached) { + for (iter = connection_cache; iter; last = iter, iter = next_cached) { + next_cached = iter->next_cached; ++global_count; if (strcmp(conn->cache_url->host, iter->cache_url->host) == 0) ++host_count; |