From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:36631) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RL7of-0002Iz-VK for qemu-devel@nongnu.org; Tue, 01 Nov 2011 02:27:22 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RL7od-0004I6-Mz for qemu-devel@nongnu.org; Tue, 01 Nov 2011 02:27:21 -0400 Received: from mtagate2.uk.ibm.com ([194.196.100.162]:59522) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RL7od-0004Hn-Cp for qemu-devel@nongnu.org; Tue, 01 Nov 2011 02:27:19 -0400 Received: from d06nrmr1707.portsmouth.uk.ibm.com (d06nrmr1707.portsmouth.uk.ibm.com [9.149.39.225]) by mtagate2.uk.ibm.com (8.13.1/8.13.1) with ESMTP id pA16RI2i014826 for ; Tue, 1 Nov 2011 06:27:18 GMT Received: from d06av04.portsmouth.uk.ibm.com (d06av04.portsmouth.uk.ibm.com [9.149.37.216]) by d06nrmr1707.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id pA16RI3U2060290 for ; Tue, 1 Nov 2011 06:27:18 GMT Received: from d06av04.portsmouth.uk.ibm.com (loopback [127.0.0.1]) by d06av04.portsmouth.uk.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id pA16RI7E031606 for ; Tue, 1 Nov 2011 00:27:18 -0600 From: Stefan Hajnoczi Date: Tue, 1 Nov 2011 06:27:10 +0000 Message-Id: <1320128830-25943-5-git-send-email-stefanha@linux.vnet.ibm.com> In-Reply-To: <1320128830-25943-1-git-send-email-stefanha@linux.vnet.ibm.com> References: <1320128830-25943-1-git-send-email-stefanha@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 4/4] acl: Fix use after free in qemu_acl_reset() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Anthony Liguori , Markus Armbruster , Stefan Hajnoczi From: Markus Armbruster Reproducer: $ MALLOC_PERTURB_=234 qemu-system-x86_64 -vnc :0,acl,sasl [...] QEMU 0.15.50 monitor - type 'help' for more information (qemu) acl_add vnc.username fred allow acl: added rule at position 1 (qemu) acl_reset vnc.username Segmentation fault (core dumped) Spotted by Coverity. Signed-off-by: Markus Armbruster Signed-off-by: Stefan Hajnoczi --- acl.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/acl.c b/acl.c index 0654f38..e840b9b 100644 --- a/acl.c +++ b/acl.c @@ -95,13 +95,13 @@ int qemu_acl_party_is_allowed(qemu_acl *acl, void qemu_acl_reset(qemu_acl *acl) { - qemu_acl_entry *entry; + qemu_acl_entry *entry, *next_entry; /* Put back to deny by default, so there is no window * of "open access" while the user re-initializes the * access control list */ acl->defaultDeny = 1; - QTAILQ_FOREACH(entry, &acl->entries, next) { + QTAILQ_FOREACH_SAFE(entry, &acl->entries, next, next_entry) { QTAILQ_REMOVE(&acl->entries, entry, next); free(entry->match); free(entry); -- 1.7.7