nfqws2: fix write after free

This commit is contained in:
bol-van
2026-04-12 20:28:43 +03:00
parent e479b0427b
commit 0151ee6fc1
+8 -6
View File
@@ -98,18 +98,20 @@ void TimerPoolRun(timer_pool **pp, uint64_t bt)
del = "timer: '%s' deleted because of error\n";
else if (elem->oneshot)
del = "timer: '%s' deleted because of oneshot\n";
if (del)
// timer function could delete the timer or recreate with the same name
p = TimerPoolSearch(*pp, name);
if (p==elem && p->n==n)
{
// timer function could delete the timer itself or recreate with the same name
p = TimerPoolSearch(*pp, name);
if (p==elem && p->n==n)
// elem is valid, not deleted and not recreated
if (del)
{
DLOG(del,name);
TimerPoolDel(pp, elem);
}
else
elem->bt_prev = bt;
}
else
elem->bt_prev = bt;
free(name);
}