diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2016-11-15 11:50:04 +0000 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2016-11-15 11:50:04 +0000 |
| commit | 5d0df6de7529edfc3f27bc04bf09fe583bdcca3e (patch) | |
| tree | 360e90e55b6e3e13173a76df659715972e908a3a | |
| parent | 972d233b1d3eacf29a281bb2dd20a52784632894 (diff) | |
| parent | ea64d5f08817b5e79e17135dce516c7583107f91 (diff) | |
| download | qemu-5d0df6de7529edfc3f27bc04bf09fe583bdcca3e.tar.gz | |
Merge remote-tracking branch 'sthibault/tags/samuel-thibault' into staging
slirp updates
# gpg: Signature made Mon 14 Nov 2016 08:19:16 PM GMT
# gpg: using RSA key 0xA003196827414880
# gpg: Good signature from "Samuel Thibault <samuel.thibault@u-bordeaux.fr>"
# gpg: aka "Samuel Thibault <sthibault@debian.org>"
# gpg: aka "Samuel Thibault <samuel.thibault@gnu.org>"
# gpg: aka "Samuel Thibault <samuel.thibault@inria.fr>"
# gpg: aka "Samuel Thibault <samuel.thibault@labri.fr>"
# gpg: aka "Samuel Thibault <samuel.thibault@ens-lyon.org>"
# Primary key fingerprint: 900C B024 B679 31D4 0F82 304B D017 8C76 7D06 9EE6
# Subkey fingerprint: 6B0F AC21 8566 46E9 4AA2 D200 A003 1968 2741 4880
* sthibault/tags/samuel-thibault:
slirp: Fix access to freed memory
Message-id: 20161114202030.17685-1-samuel.thibault@ens-lyon.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| -rw-r--r-- | slirp/socket.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/slirp/socket.c b/slirp/socket.c index 280050a21f..6c18971368 100644 --- a/slirp/socket.c +++ b/slirp/socket.c @@ -66,6 +66,23 @@ void sofree(struct socket *so) { Slirp *slirp = so->slirp; + struct mbuf *ifm; + + for (ifm = (struct mbuf *) slirp->if_fastq.qh_link; + (struct quehead *) ifm != &slirp->if_fastq; + ifm = ifm->ifq_next) { + if (ifm->ifq_so == so) { + ifm->ifq_so = NULL; + } + } + + for (ifm = (struct mbuf *) slirp->if_batchq.qh_link; + (struct quehead *) ifm != &slirp->if_batchq; + ifm = ifm->ifq_next) { + if (ifm->ifq_so == so) { + ifm->ifq_so = NULL; + } + } if (so->so_emu==EMU_RSH && so->extra) { sofree(so->extra); |