uci: fix use-after-free uci_set on update option
authorJan Venekamp <jan@venekamp.net>
Sun, 20 Nov 2022 01:08:20 +0000 (02:08 +0100)
committerHauke Mehrtens <hauke@hauke-m.de>
Sat, 4 Mar 2023 18:39:32 +0000 (19:39 +0100)
commit9b6605ec4c3ad6a6e5b6964b02a28d171a5802b5
tree684202d19536a2f7555e713420f8d481608d00a0
parentf49a2fdc4fb4a3bc95c228ade38332685197210f
uci: fix use-after-free uci_set on update option

When uci_set is called with ptr->o set and ptr->option = NULL,
then in uci_expand_ptr ptr->option is set to ptr->o->e.name.
This will result in use-after-free because ptr->option is used in
the call to uci_add_delta after uci_free_option(ptr->o).

Signed-off-by: Jan Venekamp <jan@venekamp.net>
list.c