diff options
| author | dequis <dx@dxzone.com.ar> | 2016-01-26 12:22:45 -0300 |
|---|---|---|
| committer | dequis <dx@dxzone.com.ar> | 2016-01-26 12:53:56 -0300 |
| commit | 7616eec826025932d1a2a62fc6f71887995046e0 (patch) | |
| tree | 084b62c46f53eebc01cea64a0844d5b8441bc73e | |
| parent | eee7294a4c798b04913d15df590f205b6c049281 (diff) | |
root_commands: Fix use-after-free after doing "transfer reject"
Not a big deal because as far as I can see not much happens between the
g_slist_remove() in dcc_close() and accessing files->next. I'd expect
that pointer to remain null after being freed most of the time.
| -rw-r--r-- | root_commands.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/root_commands.c b/root_commands.c index e6ed1602..4ce964ae 100644 --- a/root_commands.c +++ b/root_commands.c @@ -1237,6 +1237,7 @@ static void cmd_group(irc_t *irc, char **cmd) static void cmd_transfer(irc_t *irc, char **cmd) { GSList *files = irc->file_transfers; + GSList *next; enum { LIST, REJECT, CANCEL }; int subcmd = LIST; @@ -1254,7 +1255,8 @@ static void cmd_transfer(irc_t *irc, char **cmd) subcmd = CANCEL; } - for (; files; files = g_slist_next(files)) { + for (; files; files = next) { + next = files->next; file_transfer_t *file = files->data; switch (subcmd) { |