libopkg: fix double-free crash on recursive package removal

The opkg_remove_dependent_pkgs() function will trigger a pkg_vec_free() and
break the loop when an error is returned by opkg_remove_pkg().

Since the vector is freed anyway after the loop, a double free occurs,
leading to a segmentation fault.

This situation commonly happens when recursively deleting packages in
conjunction with --autoremove where dependent packages might already have
been removed by previous iterations.

Simply break the loop without prematurely freeing the vector to fix this.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/libopkg/opkg_remove.c b/libopkg/opkg_remove.c
index c6f2e37141c3bb7339311344eb9e52adfd988372..1ff270d7197b78b5412c3592f1d78099ebcd6dc9 100644 (file)
--- a/libopkg/opkg_remove.c
+++ b/libopkg/opkg_remove.c
@@ -138,7 +138,6 @@ opkg_remove_dependent_pkgs(pkg_t *pkg, abstract_pkg_t **dependents)
     for (i = 0; i < dependent_pkgs->len; i++) {
         err = opkg_remove_pkg(dependent_pkgs->pkgs[i],0);
         if (err) {
-            pkg_vec_free(dependent_pkgs);
             break;
        }
     }