From 135ec7c89feffe489942d5c5a37e69f4efb7d7bb Mon Sep 17 00:00:00 2001 From: Toomas Soome Date: Mon, 3 Dec 2018 13:52:28 -0800 Subject: 10014 bootadm: menu_free() is accessing freed memory Reviewed by: Andrew Stormont Reviewed by: Robert Mustacchi Reviewed by: Andy Fiddaman Reviewed by: Gergő Mihály Doma Approved by: Joshua M. Clulow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- usr/src/cmd/boot/bootadm/bootadm_loader.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'usr/src/cmd/boot') diff --git a/usr/src/cmd/boot/bootadm/bootadm_loader.c b/usr/src/cmd/boot/bootadm/bootadm_loader.c index 2a2a95c99e..3920355930 100644 --- a/usr/src/cmd/boot/bootadm/bootadm_loader.c +++ b/usr/src/cmd/boot/bootadm/bootadm_loader.c @@ -354,7 +354,9 @@ void menu_free(struct menu_lst *menu) { menu_entry_t *entry; - STAILQ_FOREACH(entry, menu, me_next) { + + while (!STAILQ_EMPTY(menu)) { + entry = STAILQ_FIRST(menu); STAILQ_REMOVE_HEAD(menu, me_next); free(entry->me_title); free(entry->me_type); -- cgit v1.2.3