Fix use-after-free in klist

attractivechaos · Nov 24, 2016 · 57ddf78 · 57ddf78
1 parent 884239d
commit 57ddf78
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/klist.h b/klist.h
@@ -99,9 +99,11 @@
 		return kl;														\
 	}																	\
 	SCOPE void kl_destroy_##name(kl_##name##_t *kl) {					\
-		kl1_##name *p;													\
-		for (p = kl->head; p != kl->tail; p = p->next)					\
+		kl1_##name *p, *next_p;											\
+		for (p = kl->head; p != kl->tail; p = next_p){					\
+			next_p = p->next;											\
 			kmp_free(name, kl->mp, p);									\
+		}																\
 		kmp_free(name, kl->mp, p);										\
 		kmp_destroy(name, kl->mp);										\
 		free(kl);														\