mirror of
git://projects.qi-hardware.com/openwrt-xburst.git
synced 2024-11-16 02:28:05 +02:00
e50605b2d9
The following test case exposed a NULL pointer dereference in uci_lua_foreach():
lua -luci -e 'x=uci.cursor(); x:foreach("firewall", "forwarding", function(s) x:delete("firewall", s[".name"]) end)'
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23757 3c298f89-4303-0410-b956-a3cf2f4a3e73
21 lines
485 B
Diff
21 lines
485 B
Diff
--- a/lua/uci.c
|
|
+++ b/lua/uci.c
|
|
@@ -266,7 +266,7 @@ uci_lua_foreach(lua_State *L)
|
|
{
|
|
struct uci_context *ctx;
|
|
struct uci_package *p;
|
|
- struct uci_element *e;
|
|
+ struct uci_element *e, *tmp;
|
|
const char *package, *type;
|
|
bool ret = false;
|
|
int offset = 0;
|
|
@@ -287,7 +287,7 @@ uci_lua_foreach(lua_State *L)
|
|
if (!p)
|
|
goto done;
|
|
|
|
- uci_foreach_element(&p->sections, e) {
|
|
+ uci_foreach_element_safe(&p->sections, tmp, e) {
|
|
struct uci_section *s = uci_to_section(e);
|
|
|
|
i++;
|