The branch main has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=8f27c9d14a559f33aa7fc3245f841f7ce52fadd5
commit 8f27c9d14a559f33aa7fc3245f841f7ce52fadd5 Author: John Baldwin <[email protected]> AuthorDate: 2022-10-03 23:10:43 +0000 Commit: John Baldwin <[email protected]> CommitDate: 2022-10-03 23:10:43 +0000 libiconv VIQR: Fix a use after free. Use TAILQ_FOREACH_SAFE to walk to list of children mnemonics to free them instead of TAILQ_FOREACH. Reviewed by: emaste Reported by: GCC 12 -Wuse-after-free Differential Revision: https://reviews.freebsd.org/D36821 --- lib/libiconv_modules/VIQR/citrus_viqr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/libiconv_modules/VIQR/citrus_viqr.c b/lib/libiconv_modules/VIQR/citrus_viqr.c index 8a81a7d12b01..f40910d8edf3 100644 --- a/lib/libiconv_modules/VIQR/citrus_viqr.c +++ b/lib/libiconv_modules/VIQR/citrus_viqr.c @@ -195,9 +195,9 @@ mnemonic_append_child(mnemonic_t *m, const char *s, static void mnemonic_destroy(mnemonic_t *m) { - mnemonic_t *m0; + mnemonic_t *m0, *n; - TAILQ_FOREACH(m0, &m->child, entry) + TAILQ_FOREACH_SAFE(m0, &m->child, entry, n) mnemonic_destroy(m0); free(m); }
