ucimap: fix use-after-free on cleanup (patch by Stanislav Fomichev)

diff --git a/ucimap.c b/ucimap.c
index 140c684f335ef750b5807f30e51cb2bd9002edf0..16ce56ad56f95b285dae58ed579928d1d58f7f98 100644 (file)
--- a/ucimap.c
+++ b/ucimap.c
@@ -162,9 +162,10 @@ ucimap_free_section(struct uci_map *map, struct ucimap_section_data *sd)
 void
 ucimap_cleanup(struct uci_map *map)
 {
-       struct ucimap_section_data *sd;
+       struct ucimap_section_data *sd, *sd_next;
 
-       for (sd = map->sdata; sd; sd = sd->next) {
+       for (sd = map->sdata; sd; sd = sd_next) {
+               sd_next = sd->next;
                ucimap_free_section(map, sd);
        }
 }