diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2013-07-31 11:17:58 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2013-08-01 13:03:42 +0200 |
| commit | a14ff8a650b5943ee6221b952494661f7cb3b5e2 (patch) | |
| tree | 7c675707d4fe4a4a76cc46f4d267910a34e4a9ba | |
| parent | 75cc1c1fcba1987bdf3979c4289ab756c2b15742 (diff) | |
usb-redir: fix use-after-free
Reinitialize dev->cs to NULL after deleting it, to make sure it isn't
used afterwards.
Reported-by: Martin Cerveny <M.Cerveny@computer.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| -rw-r--r-- | hw/usb/redirect.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c index 8b8c010d94..e3b9f324b3 100644 --- a/hw/usb/redirect.c +++ b/hw/usb/redirect.c @@ -1334,6 +1334,7 @@ static void usbredir_handle_destroy(USBDevice *udev) USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev); qemu_chr_delete(dev->cs); + dev->cs = NULL; /* Note must be done after qemu_chr_close, as that causes a close event */ qemu_bh_delete(dev->chardev_close_bh); |