diff options
| author | Timo Teräs <timo.teras@iki.fi> | 2021-01-19 16:10:08 +0200 |
|---|---|---|
| committer | Timo Teräs <timo.teras@iki.fi> | 2021-01-19 16:10:08 +0200 |
| commit | d430a989761e293e0fb042dcfe575cabdd95805a (patch) | |
| tree | 8807bb6ae3669eaf28ffbaae24b2ef3e20c4e3d6 /libfetch/common.c | |
| parent | 4087ab92c4faf21e62e85685e5960106d898386a (diff) | |
| download | apk-tools-d430a989761e293e0fb042dcfe575cabdd95805a.tar.gz apk-tools-d430a989761e293e0fb042dcfe575cabdd95805a.tar.bz2 apk-tools-d430a989761e293e0fb042dcfe575cabdd95805a.tar.xz apk-tools-d430a989761e293e0fb042dcfe575cabdd95805a.zip | |
libfetch: fix use-after-free in connection cache management
fixes #10734
Diffstat (limited to 'libfetch/common.c')
| -rw-r--r-- | libfetch/common.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libfetch/common.c b/libfetch/common.c index eb54df5..aabe218 100644 --- a/libfetch/common.c +++ b/libfetch/common.c @@ -381,7 +381,7 @@ fetch_cache_get(const struct url *url, int af) void fetch_cache_put(conn_t *conn, int (*closecb)(conn_t *)) { - conn_t *iter, *last; + conn_t *iter, *last, *next_cached; int global_count, host_count; if (conn->cache_url == NULL || cache_global_limit == 0) { @@ -391,8 +391,8 @@ fetch_cache_put(conn_t *conn, int (*closecb)(conn_t *)) global_count = host_count = 0; last = NULL; - for (iter = connection_cache; iter; - last = iter, iter = iter->next_cached) { + for (iter = connection_cache; iter; last = iter, iter = next_cached) { + next_cached = iter->next_cached; ++global_count; if (strcmp(conn->cache_url->host, iter->cache_url->host) == 0) ++host_count; |