aboutsummaryrefslogtreecommitdiffstats
path: root/package
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2010-11-01 00:20:00 +0000
committerJo-Philipp Wich <jow@openwrt.org>2010-11-01 00:20:00 +0000
commitd26484d8f600f1a0af033b122d3cedcf333c2047 (patch)
treec187c0f7157eac2eb4fa0d68e7937bd083f9d2f4 /package
parent9cd9a5a07fe14f9703afbb88903f00ab4156e263 (diff)
downloadupstream-d26484d8f600f1a0af033b122d3cedcf333c2047.tar.gz
upstream-d26484d8f600f1a0af033b122d3cedcf333c2047.tar.bz2
upstream-d26484d8f600f1a0af033b122d3cedcf333c2047.zip
[package] uci: use a delete-safe iterator in the Lua :foreach() function
The following test case exposed a NULL pointer dereference in uci_lua_foreach(): lua -luci -e 'x=uci.cursor(); x:foreach("firewall", "forwarding", function(s) x:delete("firewall", s[".name"]) end)' git-svn-id: svn://svn.openwrt.org/openwrt/trunk@23757 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package')
-rw-r--r--package/uci/Makefile2
-rw-r--r--package/uci/patches/130-lua_fix_nested_foreach_delete.patch20
2 files changed, 21 insertions, 1 deletions
diff --git a/package/uci/Makefile b/package/uci/Makefile
index 394fdf70f3..c9fc6a63c4 100644
--- a/package/uci/Makefile
+++ b/package/uci/Makefile
@@ -8,7 +8,7 @@
include $(TOPDIR)/rules.mk
UCI_VERSION=2010-09-28
-UCI_RELEASE=1
+UCI_RELEASE=2
PKG_NAME:=uci
PKG_VERSION:=$(UCI_VERSION)$(if $(UCI_RELEASE),.$(UCI_RELEASE))
diff --git a/package/uci/patches/130-lua_fix_nested_foreach_delete.patch b/package/uci/patches/130-lua_fix_nested_foreach_delete.patch
new file mode 100644
index 0000000000..70c23ad7b7
--- /dev/null
+++ b/package/uci/patches/130-lua_fix_nested_foreach_delete.patch
@@ -0,0 +1,20 @@
+--- a/lua/uci.c
++++ b/lua/uci.c
+@@ -266,7 +266,7 @@ uci_lua_foreach(lua_State *L)
+ {
+ struct uci_context *ctx;
+ struct uci_package *p;
+- struct uci_element *e;
++ struct uci_element *e, *tmp;
+ const char *package, *type;
+ bool ret = false;
+ int offset = 0;
+@@ -287,7 +287,7 @@ uci_lua_foreach(lua_State *L)
+ if (!p)
+ goto done;
+
+- uci_foreach_element(&p->sections, e) {
++ uci_foreach_element_safe(&p->sections, tmp, e) {
+ struct uci_section *s = uci_to_section(e);
+
+ i++;