diff options
| author | Daniel Scally <dan.scally@ideasonboard.com> | 2022-11-22 15:34:19 +0000 |
|---|---|---|
| committer | Kieran Bingham <kieran.bingham@ideasonboard.com> | 2022-11-22 16:07:58 +0000 |
| commit | d47c0701f2250889970afa6b5af025ea0a02b3be (patch) | |
| tree | fd1eb9675785e5c8f7dcdd4ee2ed8fe6226e4741 | |
| parent | 29ff9edaec72098f1d9e0a1f5bb18c1f6fdfdde4 (diff) | |
lib: events: Use list_for_each_entry() instead of the _safe() version
For the UVC_EVENT_STREAMOFF event, the callback frees _other_ events
because it's closing down the pipe. The use of the _safe() version
of the list iterator results in a use-after-free of those events
because they're fetched before the callback that frees them. The
_safe() version is unecessary here; no other callback's behaviour
requires it.
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
| -rw-r--r-- | lib/events.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/lib/events.c b/lib/events.c index bb18f49..ff4b7ce 100644 --- a/lib/events.c +++ b/lib/events.c @@ -104,9 +104,8 @@ static void events_dispatch(struct events *events, const fd_set *rfds, const fd_set *wfds, const fd_set *efds) { struct event_fd *event; - struct event_fd *next; - list_for_each_entry_safe(event, next, &events->events, list) { + list_for_each_entry(event, &events->events, list) { if (event->type == EVENT_READ && FD_ISSET(event->fd, rfds)) event->callback(event->priv); |