Commit d430a989 authored by Timo Teräs's avatar Timo Teräs

libfetch: fix use-after-free in connection cache management

fixes #10734
parent 4087ab92
...@@ -381,7 +381,7 @@ fetch_cache_get(const struct url *url, int af) ...@@ -381,7 +381,7 @@ fetch_cache_get(const struct url *url, int af)
void void
fetch_cache_put(conn_t *conn, int (*closecb)(conn_t *)) fetch_cache_put(conn_t *conn, int (*closecb)(conn_t *))
{ {
conn_t *iter, *last; conn_t *iter, *last, *next_cached;
int global_count, host_count; int global_count, host_count;
if (conn->cache_url == NULL || cache_global_limit == 0) { if (conn->cache_url == NULL || cache_global_limit == 0) {
...@@ -391,8 +391,8 @@ fetch_cache_put(conn_t *conn, int (*closecb)(conn_t *)) ...@@ -391,8 +391,8 @@ fetch_cache_put(conn_t *conn, int (*closecb)(conn_t *))
global_count = host_count = 0; global_count = host_count = 0;
last = NULL; last = NULL;
for (iter = connection_cache; iter; for (iter = connection_cache; iter; last = iter, iter = next_cached) {
last = iter, iter = iter->next_cached) { next_cached = iter->next_cached;
++global_count; ++global_count;
if (strcmp(conn->cache_url->host, iter->cache_url->host) == 0) if (strcmp(conn->cache_url->host, iter->cache_url->host) == 0)
++host_count; ++host_count;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment