Summary: | double-free in libtess dictDeleteDict() | ||
---|---|---|---|
Product: | Mesa | Reporter: | Tilman Sauerbeck <tilman> |
Component: | GLU | Assignee: | mesa-dev |
Status: | RESOLVED FIXED | QA Contact: | |
Severity: | normal | ||
Priority: | high | Keywords: | patch |
Version: | git | ||
Hardware: | x86 (IA32) | ||
OS: | Linux (All) | ||
Whiteboard: | |||
i915 platform: | i915 features: | ||
Attachments: | Patch |
Description
Tilman Sauerbeck
2006-04-19 23:38:24 UTC
Created attachment 5379 [details] [review] Patch It looks to me like you're referencing the value of node->next after you've free'd node (that's bad). I think we need to do something like this instead: void dictDeleteDict( Dict *dict ) { DictNode *node, *next; for( node = dict->head.next; node != &dict->head; node = next ) { next = node->next; memFree( node ); } memFree( dict ); } Whoops, you are right. That's another issue I didn't notice :) Fixed in CVS. Mass version move, cvs -> git |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.