diff options
author | Christian Grothoff <christian@grothoff.org> | 2012-05-07 08:40:43 +0000 |
---|---|---|
committer | Christian Grothoff <christian@grothoff.org> | 2012-05-07 08:40:43 +0000 |
commit | 496bd38ea991a0b130a3d17675ac9c593d7a9b09 (patch) | |
tree | 269d0e1a52f30b549a9c18b5a2fb74da6abf9f77 /src/transport/plugin_transport_unix.c | |
parent | 680b533f164771021e1019ce11aaf7c46f0a04bb (diff) | |
download | gnunet-496bd38ea991a0b130a3d17675ac9c593d7a9b09.tar.gz gnunet-496bd38ea991a0b130a3d17675ac9c593d7a9b09.zip |
-fix uaf
Diffstat (limited to 'src/transport/plugin_transport_unix.c')
-rw-r--r-- | src/transport/plugin_transport_unix.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/transport/plugin_transport_unix.c b/src/transport/plugin_transport_unix.c index b81d4d4e1..47f3f8777 100644 --- a/src/transport/plugin_transport_unix.c +++ b/src/transport/plugin_transport_unix.c | |||
@@ -280,7 +280,8 @@ static int | |||
280 | get_session_delete_it (void *cls, const GNUNET_HashCode * key, void *value) | 280 | get_session_delete_it (void *cls, const GNUNET_HashCode * key, void *value) |
281 | { | 281 | { |
282 | struct Session *s = value; | 282 | struct Session *s = value; |
283 | struct UNIXMessageWrapper * msgw; | 283 | struct UNIXMessageWrapper *msgw; |
284 | struct UNIXMessageWrapper *next; | ||
284 | struct Plugin *plugin = cls; | 285 | struct Plugin *plugin = cls; |
285 | int removed; | 286 | int removed; |
286 | GNUNET_assert (plugin != NULL); | 287 | GNUNET_assert (plugin != NULL); |
@@ -290,8 +291,11 @@ get_session_delete_it (void *cls, const GNUNET_HashCode * key, void *value) | |||
290 | 291 | ||
291 | msgw = plugin->msg_head; | 292 | msgw = plugin->msg_head; |
292 | removed = GNUNET_NO; | 293 | removed = GNUNET_NO; |
293 | for (msgw = plugin->msg_head; NULL != msgw; msgw = msgw->next) | 294 | next = plugin->msg_head; |
295 | while (NULL != next) | ||
294 | { | 296 | { |
297 | msgw = next; | ||
298 | next = msgw->next; | ||
295 | if (msgw->session != s) | 299 | if (msgw->session != s) |
296 | continue; | 300 | continue; |
297 | GNUNET_CONTAINER_DLL_remove (plugin->msg_head, plugin->msg_tail, msgw); | 301 | GNUNET_CONTAINER_DLL_remove (plugin->msg_head, plugin->msg_tail, msgw); |