Commit 6a53de92 authored by Nikias Bassen's avatar Nikias Bassen

libcnary: [BUGFIX] Set list->end to NULL when removing last and only element from list

This prevents a UaF in node_list_add. The issue became visible after removing
the last (and only) item from a PLIST_DICT or PLIST_ARRAY node, and then
adding a new item - the item will not make it into the actual dictionary or
array because the list->end pointer points to invalid memory, effectively
causing memory corruption.
parent 025d042c
......@@ -142,6 +142,8 @@ int node_list_remove(node_list_t* list, node_t* node) {
// we just removed the first element
if (newnode) {
newnode->prev = NULL;
} else {
list->end = NULL;
}
list->begin = newnode;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment