libcutils: hashmap: save next pointer in forEach before calling callback

If the callback passed to forEach tries to remove the element it was passed,
there's a use-after-free of the entry pointer in forEach.

Change-Id: Ia364b4775c9c55780b23f683b30cbff511b7f944
Signed-off-by: Dima Zavin <dima@android.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/libcutils/hashmap.c b/libcutils/hashmap.c
index e29bc246..65539ea3 100644
--- a/libcutils/hashmap.c
+++ b/libcutils/hashmap.c
@@ -310,10 +310,11 @@ void hashmapForEach(Hashmap* map,
     for (i = 0; i < map->bucketCount; i++) {
         Entry* entry = map->buckets[i];
         while (entry != NULL) {
+            Entry *next = entry->next;
             if (!callback(entry->key, entry->value, context)) {
                 return;
             }
-            entry = entry->next;
+            entry = next;
         }
     }
 }