Fix use-after-free in hash_extract().

Patch by Stephen Röttger.

2 files changed, 4 insertions, 1 deletions

diff --git a/AUTHORS b/AUTHORS
index de1e005..0e0436a 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -22,4 +22,5 @@ Ralf Paffrath
 Simon Leinen
 Simon Lundström
 Stefan Winter
+Stephen Röttger
 Stig Venaas
diff --git a/hash.c b/hash.c
index fd3c04b..19a5eba 100644
--- a/hash.c
+++ b/hash.c
@@ -92,6 +92,7 @@ void *hash_read(struct hash *h, void *key, uint32_t keylen) {
 void *hash_extract(struct hash *h, void *key, uint32_t keylen) {
     struct list_node *ln;
     struct hash_entry *e;
+    void *data;
 
     if (!h)
 	return 0;
@@ -101,9 +102,10 @@ void *hash_extract(struct hash *h, void *key, uint32_t keylen) {
 	if (e->keylen == keylen && !memcmp(e->key, key, keylen)) {
 	    free(e->key);
 	    list_removedata(h->hashlist, e);
+	    data = e->data;
 	    free(e);
 	    pthread_mutex_unlock(&h->mutex);
-	    return e->data;
+	    return data;
 	}
     }
     pthread_mutex_unlock(&h->mutex);