colin/NetworkManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

policy: fix looping through list while removing elements (rh #1175446)

Browse Source 
When g_slist_remove() was called, iter2 became invalid and accessing it
could cause a crash. The same was true for iter.
Fix the problem by getting the next list item before an element removal.

See a similar fix in bluez
http://git.kernel.org/cgit/bluetooth/bluez.git/commit/?id=be8c5be809875ba449a10ca29f5244f0231f6b63

https://bugzilla.redhat.com/show_bug.cgi?id=1175446
https://bugzilla.redhat.com/show_bug.cgi?id=1277247
This commit is contained in:
Jiří Klimeš
2015-11-04 15:48:28 +01:00
parent 7fa51f4dca
commit b9da3d9320
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/nm-policy.c
View File

@@ -752,17 +752,21 @@ process_secondaries (NMPolicy *policy,
gboolean connected) gboolean connected)
{ {
NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE (policy); NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE (policy);
GSList *iter, *iter2; GSList *iter, *iter2, *next, *next2;
/* Loop through devices waiting for secondary connections to activate */ /* Loop through devices waiting for secondary connections to activate */
for (iter = priv->pending_secondaries; iter; iter = g_slist_next (iter)) { for (iter = priv->pending_secondaries; iter; iter = next) {
PendingSecondaryData *secondary_data = (PendingSecondaryData *) iter->data; PendingSecondaryData *secondary_data = (PendingSecondaryData *) iter->data;
NMDevice *item_device = secondary_data->device; NMDevice *item_device = secondary_data->device;
next = g_slist_next (iter);
/* Look for 'active' in each device's secondary connections list */ /* Look for 'active' in each device's secondary connections list */
for (iter2 = secondary_data->secondaries; iter2; iter2 = g_slist_next (iter2)) { for (iter2 = secondary_data->secondaries; iter2; iter2 = next2) {
NMActiveConnection *secondary_active = NM_ACTIVE_CONNECTION (iter2->data); NMActiveConnection *secondary_active = NM_ACTIVE_CONNECTION (iter2->data);
next2 = g_slist_next (iter2);
if (active != secondary_active) if (active != secondary_active)
continue; continue;