From b1d2b14922f86cc668bc0cdb52ccfe470cd4395b Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Wed, 21 May 2014 14:56:16 -0500 Subject: [PATCH] core: fix use-after-free in pending action remove debug message --- src/devices/nm-device.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c index 69ba364fe4..4c04c1c831 100644 --- a/src/devices/nm-device.c +++ b/src/devices/nm-device.c @@ -7794,13 +7794,12 @@ nm_device_remove_pending_action (NMDevice *device, const char *action, gboolean for (iter = priv->pending_actions; iter; iter = iter->next) { if (!strcmp (action, iter->data)) { - g_free (iter->data); - priv->pending_actions = g_slist_delete_link (priv->pending_actions, iter); nm_log_dbg (LOGD_DEVICE, "(%s): remove_pending_action (%d): '%s'", nm_device_get_iface (device), - count + g_slist_length (iter), + count + g_slist_length (iter->next), /* length excluding 'iter' */ action); - + g_free (iter->data); + priv->pending_actions = g_slist_delete_link (priv->pending_actions, iter); if (priv->pending_actions == NULL) g_object_notify (G_OBJECT (device), NM_DEVICE_HAS_PENDING_ACTION); return TRUE;