升级2403sp1版本后，调用g_sliet_remove移除单链表的最后一个节点data，remove后data->next指针从null变成野指针

**【缺陷描述】：请补充详细的缺陷问题现象描述**
问题：调用g_sliet_remove移除单链表的最后一个节点data，remove后data->next指针从null变成野指针

2203sp3版本的data->next本来是null，g_sliet_remove后还是null
 /tmp # ./glib2free
Initial list: 1 2 3
Removing node with data 1
xsl----- data is 0xaaaaead63d00, data->next is 0xaaaaead63d10xsl----- data is 0xaaaaead63d00, data->next is (nil)Removing node with data 2
xsl----- data is 0xaaaaead63d10, data->next is 0xaaaaead63d20xsl----- data is 0xaaaaead63d10, data->next is (nil)Removing node with data 3
xsl----- data is 0xaaaaead63d20, data->next is (nil)xsl----- data is 0xaaaaead63d20, data->next is (nil)Final list:

2403sp1版本的data->next本来是null，g_sliet_remove后变成野指针了
/tmp # ./glib2free
Initial list: 1 2 3
Removing node with data 1
xsl----- data is 0xaaaab61d9470, data->next is 0xaaaab61d94b0xsl----- data is 0xaaaab61d9470, data->next is 0xd43ce57f278f25c5Removing node with data 2
xsl----- data is 0xaaaab61d94b0, data->next is 0xaaaab61d94f0xsl----- data is 0xaaaab61d94b0, data->next is 0xd43ce57f278f25c5Removing node with data 3
xsl----- data is 0xaaaab61d94f0, data->next is (nil)xsl----- data is 0xaaaab61d94f0, data->next is 0xd43ce57f278f25c5Final list:

**一、缺陷信息**

**【缺陷所属的os版本】（如openEuler-22.03-LTS，参考命令"cat /etc/os-release"结果）**

**【内核版本】（如kernel-5.10.0-60.138.0.165，参考命令"uname -r"结果）**

**【缺陷所属软件及版本号】（如kernel-5.10.0-60.138.0.165，参考命令"rpm -q 包名"结果）**

**【环境信息】**
硬件信息
aarch64 GNU/Linux
- 提供跟硬件相关的信息，如架构、cpu和内存规格等
- 虚拟机场景，额外补充宿主机os版本类型

软件信息

2403sp1版本

网络信息

- 如果有特殊组网，请提供网络拓扑信息以及网络数据走向

**【问题复现步骤】：请描述具体的操作步骤**
复现测试代码：
#include <stdio.h>
#include <glib.h>

typedef struct {
    int data;
} NodeData;

int main() {
    // 创建链表
    GSList *list = NULL;

// 创建三个节点
    NodeData *node1 = g_new(NodeData, 1);
    node1->data = 1;
    list = g_slist_append(list, node1);

NodeData *node2 = g_new(NodeData, 1);
    node2->data = 2;
    list = g_slist_append(list, node2);

NodeData *node3 = g_new(NodeData, 1);
    node3->data = 3;
    list = g_slist_append(list, node3);

// 打印初始链表
    GSList *iter = list;
    printf("Initial list: ");
    while (iter != NULL) {
        NodeData *data = (NodeData *)iter->data;
        printf("%d ", data->data);
        iter = iter->next;
    }
    printf("\n");

// 逐个删除节点
    for (int i = 0; i < 3; i++) {
        GSList *temp = list;
        NodeData *data = (NodeData *)temp->data;
        printf("Removing node with data %d\n", data->data);
        printf("xsl----- data is %p, data->next is %p", temp, temp->next);
        list = g_slist_remove(list, data);
        printf("xsl----- data is %p, data->next is %p", temp, temp->next);
        g_free(data);  // 释放节点数据
    }

// 释放剩余的链表节点（此时应该是空的）
    g_slist_free(list);

return 0;
}

**【实际结果】**，请描述出问题的结果和影响
调用g_sliet_remove释放单链表的最后一个data节点，data->next变成野指针了
**【期望结果】**，请描述出期望的结果和影响
调用g_sliet_remove释放单链表的最后一个data节点，data->next是null
**【其他相关附件信息】**
比如系统message日志/组件日志、dump信息、图片等

**【缺陷详情及分析指导参考链接】**

**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

src-openEuler/glib2
关闭

内容风险标识

评论 (5)

src-openEuler/glib2关闭 .gitee-modal { width: 500px !important; }

内容风险标识