libcnary: [BUGFIX] Set list->end to NULL when removing last and only element from list
This prevents a UaF in node_list_add. The issue became visible after removing the last (and only) item from a PLIST_DICT or PLIST_ARRAY node, and then adding a new item - the item will not make it into the actual dictionary or array because the list->end pointer points to invalid memory, effectively causing memory corruption.
Showing
Please
register
or
sign in
to comment