From f4fd1b2fb0267991ecc1e2183d5a5833d0a6c4a3 Mon Sep 17 00:00:00 2001 From: Matthew Jordan Date: Mon, 9 Apr 2012 19:44:35 +0000 Subject: Change SHARED function to use a safe traversal when modifying a variable When the SHARED function modifies a variable, it removes it from its list of variables and reinserts the new value at the head of the list of variables. Doing this inside a standard list traversal can be dangerous, as the standard list traversal does not account for the list being changed. While the code in question should not cause a use after free violation due to its breaking out of the loop after freeing the variable, it could lead to a maintenance issue if the loop was modified. This also fixes a violation reported by a static analysis tool, which also makes this code easier to maintain in the future. ........ Merged revisions 361657 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 361658 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@361659 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- funcs/func_global.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'funcs/func_global.c') diff --git a/funcs/func_global.c b/funcs/func_global.c index b4a84e4fe..de8de8a50 100644 --- a/funcs/func_global.c +++ b/funcs/func_global.c @@ -243,14 +243,15 @@ static int shared_write(struct ast_channel *chan, const char *cmd, char *data, c varshead = varstore->data; /* Protected by the channel lock */ - AST_LIST_TRAVERSE(varshead, var, entries) { + AST_LIST_TRAVERSE_SAFE_BEGIN(varshead, var, entries) { /* If there's a previous value, remove it */ if (!strcmp(args.var, ast_var_name(var))) { - AST_LIST_REMOVE(varshead, var, entries); + AST_LIST_REMOVE_CURRENT(entries); ast_var_delete(var); break; } } + AST_LIST_TRAVERSE_SAFE_END; var = ast_var_assign(args.var, S_OR(value, "")); AST_LIST_INSERT_HEAD(varshead, var, entries); -- cgit v1.2.3