|
 |
d5dcad |
autofs-5.1.4 - fix use after free in do_master_list_reset()
|
|
|
d5dcad |
|
|
|
d5dcad |
From: Ian Kent <raven@themaw.net>
|
|
|
d5dcad |
|
|
|
d5dcad |
Umm ... list_for_each() can't be used in do_master_list_reset() because
|
|
|
d5dcad |
the subject entry of the loop is removed for the list within the loop
|
|
|
d5dcad |
body. Therefore it can't be used to calculate the next pointer within a
|
|
|
d5dcad |
for (...) loop.
|
|
|
d5dcad |
|
|
|
d5dcad |
There is no list_for_each_safe() macro in the list.h of autofs so it
|
|
|
d5dcad |
needs to be done manually.
|
|
|
d5dcad |
|
|
|
d5dcad |
Signed-off-by: Ian Kent <raven@themaw.net>
|
|
|
d5dcad |
---
|
|
|
d5dcad |
CHANGELOG | 1 +
|
|
|
d5dcad |
daemon/automount.c | 8 ++++++--
|
|
|
d5dcad |
2 files changed, 7 insertions(+), 2 deletions(-)
|
|
|
d5dcad |
|
|
|
d5dcad |
diff --git a/CHANGELOG b/CHANGELOG
|
|
|
d5dcad |
index 4faab510..2747327b 100644
|
|
|
d5dcad |
--- a/CHANGELOG
|
|
|
d5dcad |
+++ b/CHANGELOG
|
|
|
d5dcad |
@@ -1,6 +1,7 @@
|
|
|
d5dcad |
xx/xx/2018 autofs-5.1.5
|
|
|
d5dcad |
- fix flag file permission.
|
|
|
d5dcad |
- fix directory create permission.
|
|
|
d5dcad |
+- fix use after free in do_master_list_reset().
|
|
|
d5dcad |
|
|
|
d5dcad |
19/12/2017 autofs-5.1.4
|
|
|
d5dcad |
- fix spec file url.
|
|
|
d5dcad |
diff --git a/daemon/automount.c b/daemon/automount.c
|
|
|
d5dcad |
index dcdc19fb..28b3f2f5 100644
|
|
|
d5dcad |
--- a/daemon/automount.c
|
|
|
d5dcad |
+++ b/daemon/automount.c
|
|
|
d5dcad |
@@ -2070,14 +2070,18 @@ static void remove_empty_args(char **argv, int *argc)
|
|
|
d5dcad |
|
|
|
d5dcad |
static void do_master_list_reset(struct master *master)
|
|
|
d5dcad |
{
|
|
|
d5dcad |
- struct list_head *head, *p;
|
|
|
d5dcad |
+ struct list_head *head, *p, *n;
|
|
|
d5dcad |
|
|
|
d5dcad |
master_mutex_lock();
|
|
|
d5dcad |
|
|
|
d5dcad |
head = &master->mounts;
|
|
|
d5dcad |
- list_for_each(p, head) {
|
|
|
d5dcad |
+ n = head->next;
|
|
|
d5dcad |
+ while (n != head) {
|
|
|
d5dcad |
struct master_mapent *entry;
|
|
|
d5dcad |
|
|
|
d5dcad |
+ p = n;
|
|
|
d5dcad |
+ n = p->next;
|
|
|
d5dcad |
+
|
|
|
d5dcad |
entry = list_entry(p, struct master_mapent, list);
|
|
|
d5dcad |
|
|
|
d5dcad |
if (!list_empty(&entry->list))
|