diff options
| author | Daniel P. Berrange <berrange@redhat.com> | 2016-04-27 11:04:52 +0100 |
|---|---|---|
| committer | Amit Shah <amit.shah@redhat.com> | 2016-05-26 11:31:09 +0530 |
| commit | d656ec5ea823bcdb59b6512cb73b3f2f97a8308f (patch) | |
| tree | b48ee797db2d516b2b84622f8e5c000ae46775b0 | |
| parent | 1fd791f007821e2510899e60be0ddad3077120e3 (diff) | |
| download | qemu-d656ec5ea823bcdb59b6512cb73b3f2f97a8308f.tar.gz | |
io: avoid double-free when closing QIOChannelBuffer
The QIOChannelBuffer's close implementation will free
the internal data buffer. It failed to reset the pointer
to NULL though, so when the object is later finalized
it will free it a second time with predictable crash.
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-Id: <1461751518-12128-3-git-send-email-berrange@redhat.com>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
| -rw-r--r-- | io/channel-buffer.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/io/channel-buffer.c b/io/channel-buffer.c index 3e5117bf28..43d795976d 100644 --- a/io/channel-buffer.c +++ b/io/channel-buffer.c @@ -140,6 +140,7 @@ static int qio_channel_buffer_close(QIOChannel *ioc, QIOChannelBuffer *bioc = QIO_CHANNEL_BUFFER(ioc); g_free(bioc->data); + bioc->data = NULL; bioc->capacity = bioc->usage = bioc->offset = 0; return 0; |