Commit 9489f1f77a4a15e1615e514cd49ed27b0be30e21

Stefan Sperling 2018-11-11T13:53:24

avoid use-after-free via got_object_idset_for_each()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
diff --git a/lib/object_idset.c b/lib/object_idset.c
index aef9d21..29ef3bd 100644
--- a/lib/object_idset.c
+++ b/lib/object_idset.c
@@ -178,9 +178,9 @@ got_object_idset_for_each(struct got_object_idset *set,
     void *arg)
 {
 	const struct got_error *err;
-	struct got_object_idset_element *entry;
+	struct got_object_idset_element *entry, *tmp;
 
-	RB_FOREACH(entry, got_object_idset_tree, &set->entries) {
+	RB_FOREACH_SAFE(entry, got_object_idset_tree, &set->entries, tmp) {
 		err = (*cb)(&entry->id, entry->data, arg);
 		if (err)
 			return err;