This fixes the use-after-free and associated crash in kconfig introduced in commit 246cf9c26bf11f2bffbecea6e5bd222eee7b1df8.
Showing the changes to scripts (2 of 2 files). Show all
Unified · Split
| @@ -165,7 +165,6 @@ struct menu { · 164 unmodified lines | |||
| 165 | struct symbol *sym; | 165 | struct symbol *sym; |
| 166 | struct property *prompt; | 166 | struct property *prompt; |
| 167 | struct expr *dep; | 167 | struct expr *dep; |
| 168 | struct expr *dir_dep; | ||
| 169 | unsigned int flags; | 168 | unsigned int flags; |
| 170 | char *help; | 169 | char *help; |
| 171 | struct file *file; | 170 | struct file *file; |
| @@ -107,7 +107,6 @@ static struct expr *menu_check_dep(struct expr *e) · 106 unmodified lines | |||
| 107 | void menu_add_dep(struct expr *dep) | 107 | void menu_add_dep(struct expr *dep) |
| 108 | { | 108 | { |
| 109 | current_entry->dep = expr_alloc_and(current_entry->dep, menu_check_dep(dep)); | 109 | current_entry->dep = expr_alloc_and(current_entry->dep, menu_check_dep(dep)); |
| 110 | current_entry->dir_dep = current_entry->dep; | ||
| 111 | } | 110 | } |
| 112 | 111 | ||
| 113 | void menu_set_type(int type) | 112 | void menu_set_type(int type) |
| @@ -291,10 +290,6 @@ void menu_finalize(struct menu *parent) · 177 unmodified lines | |||
| 291 | for (menu = parent->list; menu; menu = menu->next) | 290 | for (menu = parent->list; menu; menu = menu->next) |
| 292 | menu_finalize(menu); | 291 | menu_finalize(menu); |
| 293 | } else if (sym) { | 292 | } else if (sym) { |
| 294 | /* ignore inherited dependencies for dir_dep */ | ||
| 295 | sym->dir_dep.expr = expr_transform(expr_copy(parent->dir_dep)); | ||
| 296 | sym->dir_dep.expr = expr_eliminate_dups(sym->dir_dep.expr); | ||
| 297 | |||
| 298 | basedep = parent->prompt ? parent->prompt->visible.expr : NULL; | 293 | basedep = parent->prompt ? parent->prompt->visible.expr : NULL; |
| 299 | basedep = expr_trans_compare(basedep, E_UNEQUAL, &symbol_no); | 294 | basedep = expr_trans_compare(basedep, E_UNEQUAL, &symbol_no); |
| 300 | basedep = expr_eliminate_dups(expr_transform(basedep)); | 295 | basedep = expr_eliminate_dups(expr_transform(basedep)); |
| @@ -325,6 +320,8 @@ void menu_finalize(struct menu *parent) · 24 unmodified lines | |||
| 325 | parent->next = last_menu->next; | 320 | parent->next = last_menu->next; |
| 326 | last_menu->next = NULL; | 321 | last_menu->next = NULL; |
| 327 | } | 322 | } |
| 323 | |||
| 324 | sym->dir_dep.expr = parent->dep; | ||
| 328 | } | 325 | } |
| 329 | for (menu = parent->list; menu; menu = menu->next) { | 326 | for (menu = parent->list; menu; menu = menu->next) { |
| 330 | if (sym && sym_is_choice(sym) && | 327 | if (sym && sym_is_choice(sym) && |