修复单向列表移除节点时存在的安全风险.

Signed-off-by: vandoul <[email protected]>

Author: Vandoul

include/rtservice.h

@@ -234,6 +234,7 @@ rt_inline rt_slist_t *rt_slist_pop(rt_slist_t *l)
     if (node != (rt_slist_t *)0)
     {
         ((struct rt_slist_node *)l)->next = node->next;
+        node->next = RT_NULL;
     }
 
     return node;
@@ -246,7 +247,11 @@ rt_inline rt_slist_t *rt_slist_remove(rt_slist_t *l, rt_slist_t *n)
     while (node->next && node->next != n) node = node->next;
 
     /* remove node */
-    if (node->next != (rt_slist_t *)0) node->next = node->next->next;
+    if (node->next != (rt_slist_t *)0)
+    {
+        node->next = node->next->next;
+        n->next = RT_NULL;
+    }
 
     return l;
 }