diff options
author | Mark Wielaard <mark@klomp.org> | 2023-02-17 14:52:04 +0100 |
---|---|---|
committer | Mark Wielaard <mark@klomp.org> | 2023-02-21 12:57:04 +0100 |
commit | eb79a7bd87adc51dae77eb8d5ec37ad58ec71feb (patch) | |
tree | 60c0dfba1ba4edb4f6e2259e6ab7c2fa08ffafa1 /libasm/asm_end.c | |
parent | 77d237798c8f262d618bd3ed2db8864022bfcacb (diff) | |
download | elfutils-eb79a7bd87adc51dae77eb8d5ec37ad58ec71feb.tar.gz |
libasm: Fix use-after-free issue with circular single linked list cleanup
Pointed out by gcc 12 with -Wuse-after-free=3
In function ‘free_section’
asm_end.c:552:17: error: pointer ‘data’ used after ‘free’ [-Werror=use-after-free]
552 | while (oldp != scnp->content);
| ~~~~~^~~~~~~~~~~~~~~~
asm_end.c:550:9: note: call to ‘free’ here
550 | free (oldp);
| ^~~~~~~~~~~
Fix by freeing scnp->content last.
Signed-off-by: Mark Wielaard <mark@klomp.org>
Diffstat (limited to 'libasm/asm_end.c')
-rw-r--r-- | libasm/asm_end.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/libasm/asm_end.c b/libasm/asm_end.c index c06d2366..29165ac4 100644 --- a/libasm/asm_end.c +++ b/libasm/asm_end.c @@ -541,16 +541,18 @@ free_section (AsmScn_t *scnp) if (scnp->subnext != NULL) free_section (scnp->subnext); + /* This is a circular single linked list. */ struct AsmData *data = scnp->content; if (data != NULL) - do - { - oldp = data; - data = data->next; - free (oldp); - } - while (oldp != scnp->content); - + { + while (data != scnp->content) + { + oldp = data; + data = data->next; + free (oldp); + } + free (scnp->content); + } free (scnp); } |