diff options
| author | Mark McLoughlin <markmc@redhat.com> | 2009-11-20 18:13:10 +0000 |
|---|---|---|
| committer | Aurelien Jarno <aurelien@aurel32.net> | 2009-11-21 00:34:04 +0100 |
| commit | e0cf6d15e374c8db39acda551845ecc62f5205a3 (patch) | |
| tree | d071f240ab76c24f466571b6b4c8cb3a93175167 /slirp/mbuf.c | |
| parent | f7c703250cef231085f07352b719bb91d71ea8a1 (diff) | |
| download | qemu-e0cf6d15e374c8db39acda551845ecc62f5205a3.tar.gz | |
slirp: fix use-after-free
460fec67ee introduced a use-after free in slirp.
Cc: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Mark McLoughlin <markmc@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Diffstat (limited to 'slirp/mbuf.c')
| -rw-r--r-- | slirp/mbuf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/slirp/mbuf.c b/slirp/mbuf.c index 7652fea196..87508ba013 100644 --- a/slirp/mbuf.c +++ b/slirp/mbuf.c @@ -95,8 +95,8 @@ m_free(struct mbuf *m) * Either free() it or put it on the free list */ if (m->m_flags & M_DOFREE) { - free(m); m->slirp->mbuf_alloced--; + free(m); } else if ((m->m_flags & M_FREELIST) == 0) { insque(m,&m->slirp->m_freelist); m->m_flags = M_FREELIST; /* Clobber other flags */ |