http-push.c::remove_locks(): fix use after free

raalkml · gitster · commit 6589ebf10721 · 2009-05-24T11:08:31.000-07:00
Noticed and reported by Serhat Şevki Dinçer.

Signed-off-by: Alex Riesen &lt;raa.lkml@gmail.com&gt;
Acked-by: Clemens Buchacher &lt;drizzd@aon.at&gt;
Signed-off-by: Junio C Hamano &lt;gitster@pobox.com&gt;
diff --git a/http-push.c b/http-push.c
@@ -1356,8 +1356,9 @@ static void remove_locks(void)
 
 	fprintf(stderr, "Removing remote locks...\n");
 	while (lock) {
+		struct remote_lock *next = lock->next;
 		unlock_remote(lock);
-		lock = lock->next;
+		lock = next;
 	}
 }
 

Original file line number	Diff line number	Diff line change
`@@ -1356,8 +1356,9 @@ static void remove_locks(void)`
`1356`	`1356`
`1357`	`1357`	`fprintf(stderr, "Removing remote locks...\n");`
`1358`	`1358`	`while (lock) {`
	`1359`	`+ struct remote_lock *next = lock->next;`
`1359`	`1360`	`unlock_remote(lock);`
`1360`		`- lock = lock->next;`
	`1361`	`+ lock = next;`
`1361`	`1362`	`}`
`1362`	`1363`	`}`
`1363`	`1364`