[package] uci: use a delete-safe iterator in the Lua :foreach() function
authorJo-Philipp Wich <jow@openwrt.org>
Mon, 1 Nov 2010 00:20:00 +0000 (00:20 +0000)
committerJo-Philipp Wich <jow@openwrt.org>
Mon, 1 Nov 2010 00:20:00 +0000 (00:20 +0000)
The following test case exposed a NULL pointer dereference in uci_lua_foreach():
  lua -luci -e 'x=uci.cursor(); x:foreach("firewall", "forwarding", function(s) x:delete("firewall", s[".name"]) end)'

SVN-Revision: 23757

package/uci/Makefile
package/uci/patches/130-lua_fix_nested_foreach_delete.patch [new file with mode: 0644]

index 394fdf7..c9fc6a6 100644 (file)
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 UCI_VERSION=2010-09-28
-UCI_RELEASE=1
+UCI_RELEASE=2
 
 PKG_NAME:=uci
 PKG_VERSION:=$(UCI_VERSION)$(if $(UCI_RELEASE),.$(UCI_RELEASE))
diff --git a/package/uci/patches/130-lua_fix_nested_foreach_delete.patch b/package/uci/patches/130-lua_fix_nested_foreach_delete.patch
new file mode 100644 (file)
index 0000000..70c23ad
--- /dev/null
@@ -0,0 +1,20 @@
+--- a/lua/uci.c
++++ b/lua/uci.c
+@@ -266,7 +266,7 @@ uci_lua_foreach(lua_State *L)
+ {
+       struct uci_context *ctx;
+       struct uci_package *p;
+-      struct uci_element *e;
++      struct uci_element *e, *tmp;
+       const char *package, *type;
+       bool ret = false;
+       int offset = 0;
+@@ -287,7 +287,7 @@ uci_lua_foreach(lua_State *L)
+       if (!p)
+               goto done;
+-      uci_foreach_element(&p->sections, e) {
++      uci_foreach_element_safe(&p->sections, tmp, e) {
+               struct uci_section *s = uci_to_section(e);
+               i++;