[chunk] fix use after free / double free (fixes #2700)

From: Stefan Bühler <stbuehler@web.de> git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@3065 152afb58-edef-0310-8abb-c4023f1b3aa9
6 years ago · 6ef3b709db
2 changed files with 2 additions and 0 deletions
--- a/1
+++ b/1
@ -5,6 +5,7 @@ NEWS

 - 1.4.39
  * [core] fix memset_s call (fixes #2698)
+  * [chunk] fix use after free / double free (fixes #2700)

 - 1.4.38 - 2015-12-05
  * [stat-cache] fix handling of collisions, might have returned wrong data (fixes #2669)
--- a/src/chunk.c
+++ b/src/chunk.c
@ -172,6 +172,7 @@ static void chunkqueue_prepend_chunk(chunkqueue *cq, chunk *c) {
 }

 static void chunkqueue_append_chunk(chunkqueue *cq, chunk *c) {
+	c->next = NULL;
 	if (cq->last) {
 		cq->last->next = c;
 	}