Files
ladybird/AK
Tim Ledbetter df34c626d8 AK: Avoid UAF for consecutive SinglyLinkedList removals
The iterator returned by SinglyLinkedList::remove() left `m_prev`
default-initialized to `nullptr`. If the caller removed another element
without first advancing, the previous node's next pointer was left
dangling to the freed node.

This caused a UAF in FinalizationRegistry's `remove_by_token()` when
two consecutive records shared an unregister token.
2026-04-21 18:09:29 +02:00
..
2025-11-20 15:44:25 +01:00
2024-12-04 16:45:58 +00:00
2026-04-16 21:01:28 +02:00
2026-02-17 12:38:51 +00:00
2026-01-29 10:10:12 +01:00
2026-02-17 12:38:51 +00:00
2024-11-19 22:07:01 -07:00
2024-11-10 14:48:20 -07:00
2026-03-20 12:03:36 +01:00
2024-12-28 05:39:32 -08:00
2025-08-23 16:04:36 -06:00
2026-02-18 08:02:45 -05:00
2024-02-11 18:53:00 +01:00
2026-02-17 10:48:09 -05:00