Skip to content

R
radsecproxy
Commit eb436860 authored by Linus Nordberg's avatar Linus Nordberg Committed by Linus Nordberg
Browse files
Options

Fix use-after-free in _internal_removeserversubrealms(). 

Patch by Stephen Röttger.
parent ed86dbc5
Hide whitespace changes
Inline Side-by-side
Showing with 5 additions and 2 deletions
radsecproxy.c
View file @ eb436860
......@@ -790,6 +790,7 @@ int hasdynamicserver(struct list *srvconfs) {
void _internal_removeserversubrealms(struct list *realmlist, struct clsrvconf *srv) {
struct list_node *entry, *entry2;
struct realm *realm;
struct list *srvconfs;
for (entry = list_first(realmlist); entry;) {
realm = newrealmref((struct realm *)entry->data);
......@@ -797,16 +798,18 @@ void _internal_removeserversubrealms(struct list *realmlist, struct clsrvconf *s
entry = list_next(entry);
if (realm->srvconfs) {
srvconfs = realm->srvconfs;
for (entry2 = list_first(realm->srvconfs); entry2; entry2 = list_next(entry2))
if (entry2->data == srv)
freerealm(realm);
list_removedata(realm->srvconfs, srv);
list_removedata(srvconfs, srv);
}
if (realm->accsrvconfs) {
srvconfs = realm->accsrvconfs;
for (entry2 = list_first(realm->accsrvconfs); entry2; entry2 = list_next(entry2))
if (entry2->data == srv)
freerealm(realm);
list_removedata(realm->accsrvconfs, srv);
list_removedata(srvconfs, srv);
}
/* remove subrealm if no dynamic servers left */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment