j3d1/tinc
1
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity

Attempt to fix the heap-use-after-free error in mst_kruskal

Browse source 
For some reason the edges ware removed in one direction resulting in e->reverse
point into invalid memory.
This commit is contained in:
thorkill 2015-07-07 00:05:58 +02:00
parent 77eac310c5
commit d49fd87dbc
1 changed files with 15 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
src/edge.c
View file

@ -83,23 +83,22 @@ void free_edge(edge_t *e) {
}
void edge_add(edge_t *e) {
splay_insert(edge_weight_tree, e);
if (!e->from) {
logger(DEBUG_ALWAYS, LOG_ERR, "edge_add(): e->from is NULL!");
abort();
if (!splay_insert(edge_weight_tree, e))
logger(DEBUG_ALWAYS, LOG_ERR,
"%s:%d: edge from: %s to: %s exists in edge_weight_tree",
__FUNCTION__, __LINE__, e->from->name, e->to->name);
if (splay_insert(e->from->edge_tree, e)) {
e->reverse = lookup_edge(e->to, e->from);
if(e->reverse) {
if (e->reverse->reverse) {
logger(DEBUG_ALWAYS, LOG_ERR, "edge_add(): e->reverse->reverse should be NULL!");
abort();
}
e->reverse->reverse = e;
}
}
if (!e->to) {
logger(DEBUG_ALWAYS, LOG_ERR, "edge_add(): e->to is NULL!");
abort();
}
splay_insert(e->from->edge_tree, e);
e->reverse = lookup_edge(e->to, e->from);
if(e->reverse)
e->reverse->reverse = e;
}
void edge_del(edge_t *e) {