compile-i386 sometimes crashes due a use-after-free error. Since
f->pseudo_list is freed first, which invalidates some atom->op* in
f->atom_list. Further checks like `atom->op1->flags & STOR_WANTS_FREE'
will read garbage, which may lead to a double free.
This patch switches the cleanup order and frees f->atom_list first.
Those marked as STOR_WANTS_FREE won't appear in f->pseudo_list.
Signed-off-by: Xi Wang <xi.wang@xxxxxxxxx>
---
compile-i386.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/compile-i386.c b/compile-i386.c
index da3ee49..b470952 100644
--- a/compile-i386.c
+++ b/compile-i386.c
@@ -761,10 +761,6 @@ static void func_cleanup(struct function *f)
struct storage *stor;
struct atom *atom;
- FOR_EACH_PTR(f->pseudo_list, stor) {
- free(stor);
- } END_FOR_EACH_PTR(stor);
-
FOR_EACH_PTR(f->atom_list, atom) {
if ((atom->type == ATOM_TEXT) && (atom->text))
free(atom->text);
@@ -775,6 +771,10 @@ static void func_cleanup(struct function *f)
free(atom);
} END_FOR_EACH_PTR(atom);
+ FOR_EACH_PTR(f->pseudo_list, stor) {
+ free(stor);
+ } END_FOR_EACH_PTR(stor);
+
free_ptr_list(&f->pseudo_list);
free(f);
}
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-sparse" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
