commit 782424c6181282e14fd1273379ea5c1192ca7fc8
author Bernie Innocenti <codewiz@google.com> Thu Jul 19 18:06:52 2018 +0900
committer JP Sugarbroad <jpsugar@google.com> Tue Feb 12 13:37:26 2019 -0800
tree 4103cf75be5d8e2cf71f65f02cc95b87f23d53b3
parent edc63b58f306ff6ca6ad8987bb7f4dbd9f3ca1af

Fix use-after-free in NetworkController::removeInterfaceAddress()

Test: system/netd/tests/runtests.sh
Bug: 119496789
Change-Id: I0ebb9ac758b55f10536fef75f0eb7b69e2feccbc
(cherry picked from commit dd5a4f0ef32dbb30575a68b6869a68fc30c57dc4)
(cherry picked from commit ad883b9b99bb472c25bbd83c98724fbc4969744e)

server/NetworkController.cpp

diff --git a/server/NetworkController.cpp b/server/NetworkController.cpp
index 5bbfe3f..a260056 100644
--- a/server/NetworkController.cpp
+++ b/server/NetworkController.cpp
@@ -629,7 +629,9 @@
     std::unordered_set<unsigned>& ifindices = ifindicesIter->second;
     if (ifindices.erase(ifindex) > 0) {
         if (ifindices.size() == 0) {
-            mAddressToIfindices.erase(ifindicesIter);
+            mAddressToIfindices.erase(ifindicesIter);  // Invalidates ifindices
+            // The address is no longer configured on any interface.
+            return true;
         }
     } else {
         ALOGE("No record of address %s on interface %u", address, ifindex);