Fix use-after-free in http_stop().
authorEmil Mikulic <emikulic@gmail.com>
Sun, 7 Dec 2014 09:56:43 +0000 (20:56 +1100)
committerEmil Mikulic <emikulic@gmail.com>
Sun, 7 Dec 2014 09:57:40 +0000 (20:57 +1100)
http.c

diff --git a/http.c b/http.c
index 0cd6133..bd44ff7 100644 (file)
--- a/http.c
+++ b/http.c
@@ -1181,6 +1181,7 @@ void http_poll(fd_set *recv_set, fd_set *send_set)
 
 void http_stop(void) {
     struct connection *conn;
+    struct connection *next;
     unsigned int i;
 
     free(http_base_url);
@@ -1192,7 +1193,7 @@ void http_stop(void) {
     insocks = NULL;
 
     /* Close in-flight connections. */
-    LIST_FOREACH(conn, &connlist, entries) {
+    LIST_FOREACH_SAFE(conn, &connlist, entries, next) {
         LIST_REMOVE(conn, entries);
         free_connection(conn);
         free(conn);