Pali Rohár <[email protected]> wrote: > On Sunday 16 August 2026 12:26:41 Kirill Makurin wrote: >> >> Can we simply set `p->llink` and `p->rlink` to `NULL` after calling function >> pointed by `free_node` on them? Yes, it will still keep root node pointing >> to freed memory, but at the same time all other nodes will now point to >> `NULL`, which should prevent `twalk` from dereferencing them. > > GNU implementation is here (end of the file): > https://github.com/gnutools/glibc/blob/master/misc/tsearch.c > > It does not sets those pointers to NULL. So I think that it does not > bring any value to do it. Existing applications with this bug would have > exactly same issue on the reference GNU implementation.
Fail enough. If `tdestroy` would actually set root node to `NULL`, setting all other nodes to `NULL` has zero purpose, as `twalk` would not dereference root node to begin with. OTOH, freeing all but root node still may result in use-after-free (dereferencing stale root node), so it's basically useless. - Kirill Makurin _______________________________________________ Mingw-w64-public mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mingw-w64-public
