uci: fix a potential use-after-free in uci_set()
authorJordan Miner <jminer7@gmail.com>
Sun, 25 Mar 2018 01:30:07 +0000 (20:30 -0500)
committerHans Dedecker <dedeckeh@gmail.com>
Mon, 26 Mar 2018 19:56:33 +0000 (21:56 +0200)
commit5d2bf09ec594d97eb9284b8c721dbfe10b81a6f6
treee55bb5cad4e207b64b7430495186ab3b0fd375ea
parent3b3d63e234978e76a901b7968955a3f2e7e855d4
uci: fix a potential use-after-free in uci_set()

When calling uci_set() to update an option, if ptr->o != NULL and
ptr->option == NULL, then uci_expand_ptr() will set ptr->option to
ptr->o->e.name (or the caller could set ptr->option to that value). In
this case, the option will be freed just before calling
uci_alloc_option() with ptr->option, which was just freed.

Signed-off-by: Jordan Miner <jminer7@gmail.com>
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
list.c