修复单向列表移除节点时存在的安全风险.

Signed-off-by: vandoul <[email protected]>

1 files changed, 6 insertions, 1 deletions

diff --git a/include/rtservice.h b/include/rtservice.h
index 3d99b46151..f9612e0b55 100644
--- a/include/rtservice.h
+++ b/include/rtservice.h
@@ -234,6 +234,7 @@ rt_inline rt_slist_t *rt_slist_pop(rt_slist_t *l)
     if (node != (rt_slist_t *)0)
     {
         ((struct rt_slist_node *)l)->next = node->next;
+        node->next = RT_NULL;
     }
 
     return node;
@@ -246,7 +247,11 @@ rt_inline rt_slist_t *rt_slist_remove(rt_slist_t *l, rt_slist_t *n)
     while (node->next && node->next != n) node = node->next;
 
     /* remove node */
-    if (node->next != (rt_slist_t *)0) node->next = node->next->next;
+    if (node->next != (rt_slist_t *)0)
+    {
+        node->next = node->next->next;
+        n->next = RT_NULL;
+    }
 
     return l;
 }