Changeset 7616eec

Timestamp:

2016-01-26T15:53:56Z (9 years ago)

Author:

dequis <dx@…>

Branches:

master

Children:

db5ef3a

Parents:

eee7294

git-author:

dequis <dx@…> (26-01-16 15:22:45)

git-committer:

dequis <dx@…> (26-01-16 15:53:56)

Message:

root_commands: Fix use-after-free after doing "transfer reject"

Not a big deal because as far as I can see not much happens between the
g_slist_remove() in dcc_close() and accessing files->next. I'd expect
that pointer to remain null after being freed most of the time.

File:

• root_commands.c (modified) (2 diffs)

root_commands.c

@@ -1238 +1238 @@
 {
         GSList *files = irc->file_transfers;
+        GSList *next;
 
         enum { LIST, REJECT, CANCEL };
@@ -1255 +1256 @@
         }
 
-        for (; files; files = g_slist_next(files)) {
+        for (; files; files = next) {
+                next = files->next;
                 file_transfer_t *file = files->data;