Fix code scanning alert - Potential use after free

[igaw]

CodeQL complains about a UAF:

Memory may have been previously freed by  


ccan/ccan/strset/strset.c:196
			}

			/* Sew empty string back so remaining logic works */
			free(n->u.n);
			n->u.s = empty_str;
			break;
		}

nvme-cli/ccan/ccan/strset/strset.c

Line 211 in 79abafe

if (!streq(member, n->u.s)) {

Tracking issue for:

• https://github.com/linux-nvme/nvme-cli/security/code-scanning/57

[igaw]

Maybe we should just merge your fix. Upstream is not really responding. We did it the same for the include/define fix for bigendian too.

[ikegami-t]

Thank you. Noted.

[ikegami-t]

So can we close the issue now?

[igaw]

Let's keep it open to track upstream. I still hope it gets eventually addressed.

[ikegami-t]

I see. Thank you.