void-packages/srcpkgs/bctoolbox/patches/map-use-after-free.patch

25 lines
1.1 KiB
Diff

bctbx_iterator_ullong_get_next always return its input
return a newly allocated memory buffer instead.
changes modeled after bctbx_map_begin_type<T>
Index: bctoolbox-5.1.17/src/containers/map.cc
===================================================================
--- bctoolbox-5.1.17.orig/src/containers/map.cc
+++ bctoolbox-5.1.17/src/containers/map.cc
@@ -229,12 +229,16 @@ extern "C" bctbx_iterator_t *bctbx_itera
return bctbx_iterator_get_next_type<mmap_cchar_t>(it);
}
extern "C" bctbx_iterator_t *bctbx_iterator_ullong_get_next_and_delete(bctbx_iterator_t *it) {
+ typedef mmap_ullong_t::iterator iterator;
bctbx_iterator_t * next = bctbx_iterator_ullong_get_next(it);
+ next = (bctbx_iterator_t *)(new iterator(*((iterator *)(next))));
bctbx_iterator_ullong_delete(it);
return next;
}
extern "C" bctbx_iterator_t *bctbx_iterator_cchar_get_next_and_delete(bctbx_iterator_t *it) {
+ typedef mmap_cchar_t::iterator iterator;
bctbx_iterator_t * next = bctbx_iterator_cchar_get_next(it);
+ next = (bctbx_iterator_t *)(new iterator(*((iterator *)(next))));
bctbx_iterator_cchar_delete(it);
return next;
}