[asterisk-commits] mjordan: trunk r361659 - in /trunk: ./ funcs/func_global.c

[SVN commits to the Asterisk project]

Author: mjordan
Date: Mon Apr  9 14:44:35 2012
New Revision: 361659

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=361659
Log:
Change SHARED function to use a safe traversal when modifying a variable

When the SHARED function modifies a variable, it removes it from its list of
variables and reinserts the new value at the head of the list of variables.
Doing this inside a standard list traversal can be dangerous, as the
standard list traversal does not account for the list being changed.  While
the code in question should not cause a use after free violation due to its
breaking out of the loop after freeing the variable, it could lead to a
maintenance issue if the loop was modified.  This also fixes a violation
reported by a static analysis tool, which also makes this code easier to
maintain in the future. 
........

Merged revisions 361657 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 361658 from http://svn.asterisk.org/svn/asterisk/branches/10

Modified:
    trunk/   (props changed)
    trunk/funcs/func_global.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-10-merged' - no diff available.

Modified: trunk/funcs/func_global.c
URL: http://svnview.digium.com/svn/asterisk/trunk/funcs/func_global.c?view=diff&rev=361659&r1=361658&r2=361659
==============================================================================
--- trunk/funcs/func_global.c (original)
+++ trunk/funcs/func_global.c Mon Apr  9 14:44:35 2012
@@ -243,14 +243,15 @@
 	varshead = varstore->data;
 
 	/* Protected by the channel lock */
-	AST_LIST_TRAVERSE(varshead, var, entries) {
+	AST_LIST_TRAVERSE_SAFE_BEGIN(varshead, var, entries) {
 		/* If there's a previous value, remove it */
 		if (!strcmp(args.var, ast_var_name(var))) {
-			AST_LIST_REMOVE(varshead, var, entries);
+			AST_LIST_REMOVE_CURRENT(entries);
 			ast_var_delete(var);
 			break;
 		}
 	}
+	AST_LIST_TRAVERSE_SAFE_END;
 
 	var = ast_var_assign(args.var, S_OR(value, ""));
 	AST_LIST_INSERT_HEAD(varshead, var, entries);