commit 691260fcf5f41f8af107fdd5fa54c8362c42745c
author MingShu Pang <quic_mpang@quicinc.com> Fri Oct 21 14:27:45 2022 +0800
committer Gerrit - the friendly Code Review server <code-review@localhost> Thu Oct 27 02:03:13 2022 -0700
tree 85c9e278c17bef0cb38251a8ec6f084c722329e1
parent 21351394b8ab9475b7389453bbcd351ba579e4b9

agm: use list_for_each_safe instead of list_for_each

use-after-free can happen after removing it in
session_close if we directly use node->next.
use list_for_each_safe instead of list_for_each.

Change-Id: I81cf255f026c3c5da2d472c356fc01abf1a37bef

service/src/session_obj.c

diff --git a/service/src/session_obj.c b/service/src/session_obj.c
index be3591a..53a59f1 100644
--- a/service/src/session_obj.c
+++ b/service/src/session_obj.c
@@ -1254,6 +1254,7 @@
     struct aif *aif_obj = NULL;
     enum agm_session_mode sess_mode = sess_obj->stream_config.sess_mode;
     struct listnode *node = NULL;
+    struct listnode *next = NULL;
 
     AGM_LOGD("enter");
     if (sess_obj->state == SESSION_CLOSED) {
@@ -1279,7 +1280,7 @@
     sess_obj->loopback_state = false;
 
     if (sess_mode != AGM_SESSION_NON_TUNNEL  && sess_mode != AGM_SESSION_NO_CONFIG) {
-        list_for_each(node, &sess_obj->aif_pool) {
+        list_for_each_safe(node, next, &sess_obj->aif_pool) {
             aif_obj = node_to_item(node, struct aif, node);
             if (!aif_obj) {
                 AGM_LOGE("Error:%d could not find aif node\n", ret);