commit ad14a97019aa9cf04a3b74a63025d2a850b70966
author Samyak Jain <samyjain@codeaurora.org> Mon Apr 13 09:46:42 2020 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Sun Apr 12 21:19:16 2020 -0700
tree 6f2ba97c64e10a85575c0fb3bab2acd0149d2da2
parent f2eac4cdd6d1a304e8d23385e09040e9abdfcfd6

st-hal: Fix use-after-free in clear_devices

For removing and freeing objects during list iteration,
use list_for_each_safe which prevents use-after-free
vulnerability.

Change-Id: If410a55ac6655e2dd68fecbfdd5a16d53e45203e

sound_trigger_platform.c

diff --git a/sound_trigger_platform.c b/sound_trigger_platform.c
index 4fb305a..a031ff1 100644
--- a/sound_trigger_platform.c
+++ b/sound_trigger_platform.c
@@ -3167,13 +3167,13 @@
  */
 static int clear_devices(struct listnode *devices)
 {
-    struct listnode *node = NULL;
+    struct listnode *node = NULL, *temp = NULL;
     struct audio_device_info *item = NULL;
 
     if (devices == NULL)
         return 0;
 
-    list_for_each (node, devices) {
+    list_for_each_safe (node, temp, devices) {
         item = node_to_item(node, struct audio_device_info, list);
         if (item != NULL) {
             list_remove(&item->list);