Stale expression reference causing use-after-free

Commit Message

Catalin Marinas Sept. 21, 2010, 4:22 p.m. UTC

None

Patch

diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 7298806..e707aa2 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -107,7 +107,9 @@  static struct expr *menu_check_dep(struct expr *e)
 void menu_add_dep(struct expr *dep)
 {
 	current_entry->dep = expr_alloc_and(current_entry->dep, menu_check_dep(dep));
-	current_entry->dir_dep = current_entry->dep;
+	if (current_entry->dir_dep)
+		expr_free(current_entry->dir_dep);
+	current_entry->dir_dep = expr_copy(current_entry->dep);
 }
 
 void menu_set_type(int type)