Pali Rohár <[email protected]> wrote:

> On Sunday 16 August 2026 12:26:41 Kirill Makurin wrote:
>>
>> Can we simply set `p->llink` and `p->rlink` to `NULL` after calling function 
>> pointed by `free_node` on them? Yes, it will still keep root node pointing 
>> to freed memory, but at the same time all other nodes will now point to 
>> `NULL`, which should prevent `twalk` from dereferencing them.
>
> GNU implementation is here (end of the file):
> https://github.com/gnutools/glibc/blob/master/misc/tsearch.c
>
> It does not sets those pointers to NULL. So I think that it does not
> bring any value to do it. Existing applications with this bug would have
> exactly same issue on the reference GNU implementation.

Fail enough.

If `tdestroy` would actually set root node to `NULL`, setting all other nodes 
to `NULL` has zero purpose, as `twalk` would not dereference root node to begin 
with. OTOH, freeing all but root node still may result in use-after-free 
(dereferencing stale root node), so it's basically useless.

- Kirill Makurin

_______________________________________________
Mingw-w64-public mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mingw-w64-public

Reply via email to