CVSROOT: /sources/gnash
Module name: gnash
Changes by: Sandro Santilli <strk> 07/11/16 19:43:43
Modified files:
. : ChangeLog
server : array.h
Log message:
(visitAll): copy the container before executing arbitrary code while
iterating over it. Fixes a memory corruption.
CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.4881&r2=1.4882
http://cvs.savannah.gnu.org/viewcvs/gnash/server/array.h?cvsroot=gnash&r1=1.37&r2=1.38
Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.4881
retrieving revision 1.4882
diff -u -b -r1.4881 -r1.4882
--- ChangeLog 16 Nov 2007 17:35:33 -0000 1.4881
+++ ChangeLog 16 Nov 2007 19:43:43 -0000 1.4882
@@ -1,5 +1,7 @@
2007-11-16 Sandro Santilli <[EMAIL PROTECTED]>
+ * server/array.h (visitAll): copy the container before executing
+ arbitrary code while iterating over it. Fixes a memory corruption.
* server/asobj/Key.{cpp,h}: Initialize the Key object as an usual
AsBroadcaster.
* server/movie_root.cpp: don't cleanup Key object listeners as they
Index: server/array.h
===================================================================
RCS file: /sources/gnash/gnash/server/array.h,v
retrieving revision 1.37
retrieving revision 1.38
diff -u -b -r1.37 -r1.38
--- server/array.h 18 Oct 2007 11:47:54 -0000 1.37
+++ server/array.h 16 Nov 2007 19:43:43 -0000 1.38
@@ -66,7 +66,10 @@
///
template<class V> void visitAll(V& v)
{
- for (iterator i=elements.begin(), ie=elements.end(); i!=ie; ++i)
+ // NOTE: we copy the elements as the visitor might call
arbitrary code
+ // possibly modifying the container itself.
+ container copy = elements;
+ for (iterator i=copy.begin(), ie=copy.end(); i!=ie; ++i)
{
v.visit(*i);
}
_______________________________________________
Gnash-commit mailing list
Gnash-commit@gnu.org
http://lists.gnu.org/mailman/listinfo/gnash-commit
