uci: use a delete-safe iterator in the Lua :foreach() function The following test case exposed a NULL pointer dereference in uci_lua_foreach(): lua -luci -e 'x=uci.cursor(); x:foreach("firewall", "forwarding", function(s) x:delete("firewall", s[".name"]) end)'
SVN-Revision: 23757
This commit is contained in:
parent
21aeb28779
commit
f52274bf2f
@ -8,7 +8,7 @@
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
UCI_VERSION=2010-09-28
|
||||
UCI_RELEASE=1
|
||||
UCI_RELEASE=2
|
||||
|
||||
PKG_NAME:=uci
|
||||
PKG_VERSION:=$(UCI_VERSION)$(if $(UCI_RELEASE),.$(UCI_RELEASE))
|
||||
|
20
package/uci/patches/130-lua_fix_nested_foreach_delete.patch
Normal file
20
package/uci/patches/130-lua_fix_nested_foreach_delete.patch
Normal file
@ -0,0 +1,20 @@
|
||||
--- a/lua/uci.c
|
||||
+++ b/lua/uci.c
|
||||
@@ -266,7 +266,7 @@ uci_lua_foreach(lua_State *L)
|
||||
{
|
||||
struct uci_context *ctx;
|
||||
struct uci_package *p;
|
||||
- struct uci_element *e;
|
||||
+ struct uci_element *e, *tmp;
|
||||
const char *package, *type;
|
||||
bool ret = false;
|
||||
int offset = 0;
|
||||
@@ -287,7 +287,7 @@ uci_lua_foreach(lua_State *L)
|
||||
if (!p)
|
||||
goto done;
|
||||
|
||||
- uci_foreach_element(&p->sections, e) {
|
||||
+ uci_foreach_element_safe(&p->sections, tmp, e) {
|
||||
struct uci_section *s = uci_to_section(e);
|
||||
|
||||
i++;
|
Loading…
Reference in New Issue
Block a user