[src/trunk]: src/external/bsd/mdocml/dist CPID 1288934: This is not really a ...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/86c91dcdf2d8
branches:  trunk
changeset: 342755:86c91dcdf2d8
user:      christos <christos%NetBSD.org@localhost>
date:      Thu Jan 07 20:05:41 2016 +0000

description:
CPID 1288934: This is not really a use after free, because the last pointer
is updated in the mdoc_node_unlink.

diffstat:

 external/bsd/mdocml/dist/mdoc_validate.c |  8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)

diffs (22 lines):

diff -r ce6e360ff1e5 -r 86c91dcdf2d8 external/bsd/mdocml/dist/mdoc_validate.c
--- a/external/bsd/mdocml/dist/mdoc_validate.c  Thu Jan 07 20:00:35 2016 +0000
+++ b/external/bsd/mdocml/dist/mdoc_validate.c  Thu Jan 07 20:05:41 2016 +0000
@@ -1,4 +1,4 @@
-/*     $Id: mdoc_validate.c,v 1.8 2016/01/07 19:46:00 christos Exp $ */
+/*     $Id: mdoc_validate.c,v 1.9 2016/01/07 20:05:41 christos Exp $ */
 /*
  * Copyright (c) 2008-2012 Kristaps Dzonsons <kristaps%bsd.lv@localhost>
  * Copyright (c) 2010-2015 Ingo Schwarze <schwarze%openbsd.org@localhost>
@@ -902,8 +902,10 @@
                mandoc_vmsg(MANDOCERR_ARG_EXCESS, mdoc->parse,
                    n->child->next->line, n->child->next->pos,
                    "Fo ... %s", n->child->next->string);
-               while (n->child != n->last)
-                       mdoc_node_delete(mdoc, n->last);
+               while (n->child != n->last) {
+                       struct mdoc_node *p = n->last;
+                       mdoc_node_delete(mdoc, p);
+               }
        }
 
        post_fname(mdoc);