[Gnash-commit] gnash ChangeLog server/array.h

[Sandro Santilli]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Sandro Santilli <strk>  07/11/16 19:43:43

Modified files:
        .              : ChangeLog 
        server         : array.h 

Log message:
        (visitAll): copy the container before executing arbitrary code while 
iterating over it. Fixes a memory corruption.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.4881&r2=1.4882
http://cvs.savannah.gnu.org/viewcvs/gnash/server/array.h?cvsroot=gnash&r1=1.37&r2=1.38

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.4881
retrieving revision 1.4882
diff -u -b -r1.4881 -r1.4882
--- ChangeLog   16 Nov 2007 17:35:33 -0000      1.4881
+++ ChangeLog   16 Nov 2007 19:43:43 -0000      1.4882
@@ -1,5 +1,7 @@
 2007-11-16 Sandro Santilli <address@hidden>
 
+       * server/array.h (visitAll): copy the container before executing
+         arbitrary code while iterating over it. Fixes a memory corruption.
        * server/asobj/Key.{cpp,h}: Initialize the Key object as an usual
          AsBroadcaster.
        * server/movie_root.cpp: don't cleanup Key object listeners as they

Index: server/array.h
===================================================================
RCS file: /sources/gnash/gnash/server/array.h,v
retrieving revision 1.37
retrieving revision 1.38
diff -u -b -r1.37 -r1.38
--- server/array.h      18 Oct 2007 11:47:54 -0000      1.37
+++ server/array.h      16 Nov 2007 19:43:43 -0000      1.38
@@ -66,7 +66,10 @@
        ///
        template<class V> void visitAll(V& v)
        {
-               for (iterator i=elements.begin(), ie=elements.end(); i!=ie; ++i)
+               // NOTE: we copy the elements as the visitor might call 
arbitrary code
+               //       possibly modifying the container itself.
+               container copy = elements;
+               for (iterator i=copy.begin(), ie=copy.end(); i!=ie; ++i)
                {
                        v.visit(*i);
                }