[cadcdev-svn-commits] [SCM] branch master updated. 41f2fd3f82d822099cdcea8f08e323c24da84d2c

[falcovorbis <fal...@us...>]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "A pseudo Operating System for the Dreamcast.".

The branch, master has been updated
       via  41f2fd3f82d822099cdcea8f08e323c24da84d2c (commit)
      from  9ced3a9b8b3f0cbbce7c5c1dc83cfa9376fa3e7d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 41f2fd3f82d822099cdcea8f08e323c24da84d2c
Author: Donald Haase <qu...@ya...>
Date:   Mon Oct 21 01:17:29 2024 -0400

    The sys/queue `_FOREACH` functions are not safe to free their elements. (#823)
    
    Swap usage to the `_FOREACH_SAFE` which is the safe version.
    Without this, each time `qpkt` is freed, the next loop iteration is
    based on a use-after-free.
    
    Co-authored-by: QuzarDC <qu...@co...>

-----------------------------------------------------------------------

Summary of changes:
 kernel/net/net_dhcp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/net/net_dhcp.c b/kernel/net/net_dhcp.c
index 064a8964..b14e159e 100644
--- a/kernel/net/net_dhcp.c
+++ b/kernel/net/net_dhcp.c
@@ -480,7 +480,7 @@ static void net_dhcp_bind(dhcp_pkt_t *pkt, int len) {
 }
 
 static void net_dhcp_thd(void *obj) {
-    struct dhcp_pkt_out *qpkt;
+    struct dhcp_pkt_out *qpkt, *q_tmp;
     uint64 now;
     struct sockaddr_in addr;
     uint8 buf[1500];
@@ -499,7 +499,7 @@ static void net_dhcp_thd(void *obj) {
     /* Make sure we don't need to renew our lease */
     if(lease_expires <= now && (state == DHCP_STATE_BOUND ||
                                 state == DHCP_STATE_RENEWING || state == DHCP_STATE_REBINDING)) {
-        STAILQ_FOREACH(qpkt, &dhcp_pkts, pkt_queue) {
+        STAILQ_FOREACH_SAFE(qpkt, &dhcp_pkts, pkt_queue, q_tmp) {
             STAILQ_REMOVE(&dhcp_pkts, qpkt, dhcp_pkt_out, pkt_queue);
             free(qpkt->buf);
             free(qpkt);
@@ -513,7 +513,7 @@ static void net_dhcp_thd(void *obj) {
     else if(rebind_time <= now &&
             (state == DHCP_STATE_BOUND || state == DHCP_STATE_RENEWING)) {
         /* Clear out any existing packets. */
-        STAILQ_FOREACH(qpkt, &dhcp_pkts, pkt_queue) {
+        STAILQ_FOREACH_SAFE(qpkt, &dhcp_pkts, pkt_queue, q_tmp) {
             STAILQ_REMOVE(&dhcp_pkts, qpkt, dhcp_pkt_out, pkt_queue);
             free(qpkt->buf);
             free(qpkt);


hooks/post-receive
-- 
A pseudo Operating System for the Dreamcast.