From 496bd38ea991a0b130a3d17675ac9c593d7a9b09 Mon Sep 17 00:00:00 2001
From: Christian Grothoff <christian@grothoff.org>
Date: Mon, 7 May 2012 08:40:43 +0000
Subject: [PATCH] -fix uaf

---
 src/transport/plugin_transport_unix.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/transport/plugin_transport_unix.c b/src/transport/plugin_transport_unix.c
index b81d4d4e1..47f3f8777 100644
--- a/src/transport/plugin_transport_unix.c
+++ b/src/transport/plugin_transport_unix.c
@@ -280,7 +280,8 @@ static int
 get_session_delete_it (void *cls, const GNUNET_HashCode * key, void *value)
 {
   struct Session *s = value;
-  struct UNIXMessageWrapper * msgw;
+  struct UNIXMessageWrapper *msgw;
+  struct UNIXMessageWrapper *next;
   struct Plugin *plugin = cls;
   int removed;
   GNUNET_assert (plugin != NULL);
@@ -290,8 +291,11 @@ get_session_delete_it (void *cls, const GNUNET_HashCode * key, void *value)
 
   msgw = plugin->msg_head;
   removed = GNUNET_NO;
-  for (msgw = plugin->msg_head; NULL != msgw; msgw = msgw->next)
+  next = plugin->msg_head;
+  while (NULL != next)
   {
+    msgw = next;
+    next = msgw->next;
     if (msgw->session != s)
       continue;
     GNUNET_CONTAINER_DLL_remove (plugin->msg_head, plugin->msg_tail, msgw);
-- 
2.25.1