CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/07/08 07:59:26
Modified files:
usr.sbin/rpki-client: repo.c
Log message:
Don't remove other elements in a RB_FOREACH_SAFE walk since that is not safe.
repo_move_valid() walks the tree with RB_FOREACH_SAFE() but it also calls
RB_REMOVE() via filepath_put() on an other element in a case where a
conflict is resolved. This results in a use-after-free if that element is
the next one in the tree (nfp). Instead of removing the present
conflicting node (ofp), replace the contents of it, free fp and swap fp
with ofp.
With and OK tb@
