From: Florian Westphal <fw@strlen.de>
Date: Mon, 14 Dec 2020 15:53:29 +0000 (+0100)
Subject: json: don't leave dangling pointers on hlist
X-Git-Tag: v0.9.8~13
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=48917d876d51cd6ba5bff07172acef05c9e12474;p=thirdparty%2Fnftables.git

json: don't leave dangling pointers on hlist

unshare -n tests/json_echo/run-test.py
[..]
Adding chain c
free(): double free detected in tcache 2
Aborted (core dumped)

The element must be deleted from the hlist prior to freeing it.

Fixes: 389a0e1edc89a ("json: echo: Speedup seqnum_to_json()")
Signed-off-by: Florian Westphal <fw@strlen.de>
---

diff --git a/src/parser_json.c b/src/parser_json.c
index 09e394df..f0486b77 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -3786,8 +3786,10 @@ static void json_cmd_assoc_free(void)
 
 	for (i = 0; i < CMD_ASSOC_HSIZE; i++) {
 		hlist_for_each_entry_safe(cur, pos, n,
-					  &json_cmd_assoc_hash[i], hnode)
+					  &json_cmd_assoc_hash[i], hnode) {
+			hlist_del(&cur->hnode);
 			free(cur);
+		}
 	}
 }