libctf: ctf_dynhash_next_remove: fix crash on error case

If this is called on an errored-out or freed iterator, it's meant to do
nothing, just like free().  Instead, it dereferences a null pointer due
to a couple of early tests being done in the wrong order.

Fix that.

libctf/
	* ctf-hash.c (ctf_dynhash_next_remove): Check for null iterator
	before dereferencing it.

diff --git a/libctf/ctf-hash.c b/libctf/ctf-hash.c
index d8941420f008815445fb6415e66df8e547d86592..ac0e3cb783c1dc4f6d50068bb1efa0a126216069 100644 (file)
--- a/libctf/ctf-hash.c
+++ b/libctf/ctf-hash.c
@@ -598,12 +598,12 @@ ctf_dynhash_next_remove (ctf_next_t * const *it)
 {
   ctf_next_t *i = *it;
 
-  if ((void (*) (void)) ctf_dynhash_next != i->ctn_iter_fun)
-    return ECTF_NEXT_WRONGFUN;
-
   if (!i)
     return ECTF_NEXT_END;
 
+  if ((void (*) (void)) ctf_dynhash_next != i->ctn_iter_fun)
+    return ECTF_NEXT_WRONGFUN;
+
   if (i->ctn_n == 0)
     return ECTF_NEXT_END;