Commit 4fab9ac0 authored Mar 24, 2011 by Dima Zavin

libcutils: hashmap: save next pointer in forEach before calling callback



If the callback passed to forEach tries to remove the element it was passed,
there's a use-after-free of the entry pointer in forEach.

Change-Id: Ia364b4775c9c55780b23f683b30cbff511b7f944
Signed-off-by: Dima Zavin <dima@android.com>

parent bdaaec1b

libcutils/hashmap.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -310,10 +310,11 @@ void hashmapForEach(Hashmap* map,
		for (i = 0; i < map->bucketCount; i++) {
		Entry* entry = map->buckets[i];
		while (entry != NULL) {
		Entry *next = entry->next;
		if (!callback(entry->key, entry->value, context)) {
		return;
		}
		entry = entry->next;
		entry = next;
		}
		}
		}