diff options
| author | Jo-Philipp Wich <jow@openwrt.org> | 2010-11-01 00:20:00 +0000 |
|---|---|---|
| committer | Jo-Philipp Wich <jow@openwrt.org> | 2010-11-01 00:20:00 +0000 |
| commit | f52274bf2fae35c07e0a1801b46b68b9e8179c25 (patch) | |
| tree | 6e1a82a2e81ef879a89713e5fdb06ee74de617bc | |
| parent | 21aeb28779a02c1c0cac637981f2a6cee155d457 (diff) | |
| download | upstream-f52274bf2fae35c07e0a1801b46b68b9e8179c25.tar.gz upstream-f52274bf2fae35c07e0a1801b46b68b9e8179c25.tar.bz2 upstream-f52274bf2fae35c07e0a1801b46b68b9e8179c25.zip | |
uci: use a delete-safe iterator in the Lua :foreach() function The following test case exposed a NULL pointer dereference in uci_lua_foreach(): lua -luci -e 'x=uci.cursor(); x:foreach("firewall", "forwarding", function(s) x:delete("firewall", s[".name"]) end)'
SVN-Revision: 23757
| -rw-r--r-- | package/uci/Makefile | 2 | ||||
| -rw-r--r-- | package/uci/patches/130-lua_fix_nested_foreach_delete.patch | 20 |
2 files changed, 21 insertions, 1 deletions
diff --git a/package/uci/Makefile b/package/uci/Makefile index 394fdf70f3..c9fc6a63c4 100644 --- a/package/uci/Makefile +++ b/package/uci/Makefile @@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk UCI_VERSION=2010-09-28 -UCI_RELEASE=1 +UCI_RELEASE=2 PKG_NAME:=uci PKG_VERSION:=$(UCI_VERSION)$(if $(UCI_RELEASE),.$(UCI_RELEASE)) diff --git a/package/uci/patches/130-lua_fix_nested_foreach_delete.patch b/package/uci/patches/130-lua_fix_nested_foreach_delete.patch new file mode 100644 index 0000000000..70c23ad7b7 --- /dev/null +++ b/package/uci/patches/130-lua_fix_nested_foreach_delete.patch @@ -0,0 +1,20 @@ +--- a/lua/uci.c ++++ b/lua/uci.c +@@ -266,7 +266,7 @@ uci_lua_foreach(lua_State *L) + { + struct uci_context *ctx; + struct uci_package *p; +- struct uci_element *e; ++ struct uci_element *e, *tmp; + const char *package, *type; + bool ret = false; + int offset = 0; +@@ -287,7 +287,7 @@ uci_lua_foreach(lua_State *L) + if (!p) + goto done; + +- uci_foreach_element(&p->sections, e) { ++ uci_foreach_element_safe(&p->sections, tmp, e) { + struct uci_section *s = uci_to_section(e); + + i++; |