efl_ui_internal_text_interactive: prevent from freed memory accessing

If node_format_remove_pair frees node, then next for loop can lead
invalid memory accessing. This patch prevents from that case by keeping
the next node before freeing.

1 files changed, 9 insertions, 5 deletions

diff --git a/src/lib/elementary/efl_ui_internal_text_interactive.c b/src/lib/elementary/efl_ui_internal_text_interactive.c
index 017f2a884b..a0bbba6469 100644
--- a/src/lib/elementary/efl_ui_internal_text_interactive.c
+++ b/src/lib/elementary/efl_ui_internal_text_interactive.c
@@ -158,21 +158,25 @@ Eina_Bool
 _entry_hide_visible_password(Eo *obj)
 {
    Eina_Bool b_ret = EINA_FALSE;
-   const Evas_Object_Textblock_Node_Format *node;
+   const Evas_Object_Textblock_Node_Format *node, *node_next;
    node = evas_textblock_node_format_first_get(obj);
-   for (; node; node = evas_textblock_node_format_next_get(node))
+
+   if (!node) return EINA_FALSE;
+
+   do
      {
+        node_next = evas_textblock_node_format_next_get(node);
         const char *text = evas_textblock_node_format_text_get(node);
         if (text)
           {
              if (!strcmp(text, "+ password=off"))
                {
-                  evas_textblock_node_format_remove_pair(obj,
-                                                         (Evas_Object_Textblock_Node_Format *)node);
+                  evas_textblock_node_format_remove_pair(obj, (Evas_Object_Textblock_Node_Format *)node);
                   b_ret = EINA_TRUE;
                }
           }
-     }
+        node = node_next;
+     } while (node);
 
    return b_ret;
 }