aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDaniel P. Berrange <berrange@redhat.com>2016-04-27 11:04:52 +0100
committerAmit Shah <amit.shah@redhat.com>2016-05-26 11:31:09 +0530
commitd656ec5ea823bcdb59b6512cb73b3f2f97a8308f (patch)
treeb48ee797db2d516b2b84622f8e5c000ae46775b0
parent1fd791f007821e2510899e60be0ddad3077120e3 (diff)
downloadqemu-arm-d656ec5ea823bcdb59b6512cb73b3f2f97a8308f.tar.gz
io: avoid double-free when closing QIOChannelBuffer
The QIOChannelBuffer's close implementation will free the internal data buffer. It failed to reset the pointer to NULL though, so when the object is later finalized it will free it a second time with predictable crash. Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> Message-Id: <1461751518-12128-3-git-send-email-berrange@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com>
-rw-r--r--io/channel-buffer.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/io/channel-buffer.c b/io/channel-buffer.c
index 3e5117bf28..43d795976d 100644
--- a/io/channel-buffer.c
+++ b/io/channel-buffer.c
@@ -140,6 +140,7 @@ static int qio_channel_buffer_close(QIOChannel *ioc,
QIOChannelBuffer *bioc = QIO_CHANNEL_BUFFER(ioc);
g_free(bioc->data);
+ bioc->data = NULL;
bioc->capacity = bioc->usage = bioc->offset = 0;
return 0;