libcutils: hashmap: save next pointer in forEach before calling callback
If the callback passed to forEach tries to remove the element it was passed,
there's a use-after-free of the entry pointer in forEach.
Change-Id: Ia364b4775c9c55780b23f683b30cbff511b7f944
Signed-off-by: Dima Zavin <dima@android.com>
diff --git a/libcutils/hashmap.c b/libcutils/hashmap.c
index e29bc24..65539ea 100644
--- a/libcutils/hashmap.c
+++ b/libcutils/hashmap.c
@@ -310,10 +310,11 @@
for (i = 0; i < map->bucketCount; i++) {
Entry* entry = map->buckets[i];
while (entry != NULL) {
+ Entry *next = entry->next;
if (!callback(entry->key, entry->value, context)) {
return;
}
- entry = entry->next;
+ entry = next;
}
}
}