Commit ed86dbc5 authored by Linus Nordberg's avatar Linus Nordberg Committed by Linus Nordberg

Fix use-after-free in hash_extract().

Patch by Stephen Röttger.
parent 8dd3a960
......@@ -22,4 +22,5 @@ Ralf Paffrath
Simon Leinen
Simon Lundström
Stefan Winter
Stephen Röttger
Stig Venaas
......@@ -92,6 +92,7 @@ void *hash_read(struct hash *h, void *key, uint32_t keylen) {
void *hash_extract(struct hash *h, void *key, uint32_t keylen) {
struct list_node *ln;
struct hash_entry *e;
void *data;
if (!h)
return 0;
......@@ -101,9 +102,10 @@ void *hash_extract(struct hash *h, void *key, uint32_t keylen) {
if (e->keylen == keylen && !memcmp(e->key, key, keylen)) {
free(e->key);
list_removedata(h->hashlist, e);
data = e->data;
free(e);
pthread_mutex_unlock(&h->mutex);
return e->data;
return data;
}
}
pthread_mutex_unlock(&h->mutex);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment