From 169d84d65adbddf4e08fea812af15f4ca51f389a Mon Sep 17 00:00:00 2001 From: vandoul Date: Tue, 10 Jun 2025 10:01:07 +0800 Subject: 修复单向列表移除节点时存在的安全风险. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: vandoul --- include/rtservice.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/rtservice.h b/include/rtservice.h index 3d99b46151..f9612e0b55 100644 --- a/include/rtservice.h +++ b/include/rtservice.h @@ -234,6 +234,7 @@ rt_inline rt_slist_t *rt_slist_pop(rt_slist_t *l) if (node != (rt_slist_t *)0) { ((struct rt_slist_node *)l)->next = node->next; + node->next = RT_NULL; } return node; @@ -246,7 +247,11 @@ rt_inline rt_slist_t *rt_slist_remove(rt_slist_t *l, rt_slist_t *n) while (node->next && node->next != n) node = node->next; /* remove node */ - if (node->next != (rt_slist_t *)0) node->next = node->next->next; + if (node->next != (rt_slist_t *)0) + { + node->next = node->next->next; + n->next = RT_NULL; + } return l; } -- cgit v1.3.1