This fixes the use-after-free and associated crash in kconfig introduced in commit 246cf9c26bf11f2bffbecea6e5bd222eee7b1df8.
Showing the changes to scripts (2 of 2 files). Show all
Unified · Split
| @@ -165,7 +165,6 @@ struct menu { · 164 unmodified lines | ||
| 165 | 165 | struct symbol *sym; |
| 166 | 166 | struct property *prompt; |
| 167 | 167 | struct expr *dep; |
| 168 | − struct expr *dir_dep; | |
| 169 | 168 | unsigned int flags; |
| 170 | 169 | char *help; |
| 171 | 170 | struct file *file; |
| @@ -107,7 +107,6 @@ static struct expr *menu_check_dep(struct expr *e) · 106 unmodified lines | ||
| 107 | 107 | void menu_add_dep(struct expr *dep) |
| 108 | 108 | { |
| 109 | 109 | current_entry->dep = expr_alloc_and(current_entry->dep, menu_check_dep(dep)); |
| 110 | − current_entry->dir_dep = current_entry->dep; | |
| 111 | 110 | } |
| 112 | 111 | |
| 113 | 112 | void menu_set_type(int type) |
| @@ -291,10 +290,6 @@ void menu_finalize(struct menu *parent) · 177 unmodified lines | ||
| 291 | 290 | for (menu = parent->list; menu; menu = menu->next) |
| 292 | 291 | menu_finalize(menu); |
| 293 | 292 | } else if (sym) { |
| 294 | − /* ignore inherited dependencies for dir_dep */ | |
| 295 | − sym->dir_dep.expr = expr_transform(expr_copy(parent->dir_dep)); | |
| 296 | − sym->dir_dep.expr = expr_eliminate_dups(sym->dir_dep.expr); | |
| 297 | − | |
| 298 | 293 | basedep = parent->prompt ? parent->prompt->visible.expr : NULL; |
| 299 | 294 | basedep = expr_trans_compare(basedep, E_UNEQUAL, &symbol_no); |
| 300 | 295 | basedep = expr_eliminate_dups(expr_transform(basedep)); |
| @@ -325,6 +320,8 @@ void menu_finalize(struct menu *parent) · 24 unmodified lines | ||
| 325 | 320 | parent->next = last_menu->next; |
| 326 | 321 | last_menu->next = NULL; |
| 327 | 322 | } |
| 323 | + | |
| 324 | + sym->dir_dep.expr = parent->dep; | |
| 328 | 325 | } |
| 329 | 326 | for (menu = parent->list; menu; menu = menu->next) { |
| 330 | 327 | if (sym && sym_is_choice(sym) && |