From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:39887) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SCsMt-00059G-Dz for qemu-devel@nongnu.org; Wed, 28 Mar 2012 08:53:00 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SCsMq-0007qF-T7 for qemu-devel@nongnu.org; Wed, 28 Mar 2012 08:52:50 -0400 From: =?UTF-8?q?Andreas=20F=C3=A4rber?= Date: Wed, 28 Mar 2012 14:52:14 +0200 Message-Id: <1332939159-16434-12-git-send-email-afaerber@suse.de> In-Reply-To: <1332939159-16434-1-git-send-email-afaerber@suse.de> References: <1332939159-16434-1-git-send-email-afaerber@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH stable-0.15 11/36] acl: Fix use after free in qemu_acl_reset() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Stefan Hajnoczi , Markus Armbruster , kvm@suse.de, qemu-stable@nongnu.org, Bruce Rogers , =?UTF-8?q?Andreas=20F=C3=A4rber?= From: Markus Armbruster Reproducer: $ MALLOC_PERTURB_=3D234 qemu-system-x86_64 -vnc :0,acl,sasl [...] QEMU 0.15.50 monitor - type 'help' for more information (qemu) acl_add vnc.username fred allow acl: added rule at position 1 (qemu) acl_reset vnc.username Segmentation fault (core dumped) Spotted by Coverity. Signed-off-by: Markus Armbruster Signed-off-by: Stefan Hajnoczi (cherry picked from commit 0ce6a434176e274a7e86bcaa268542c5cc402696) Signed-off-by: Bruce Rogers Signed-off-by: Andreas F=C3=A4rber --- acl.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/acl.c b/acl.c index 82c2704..cae059f 100644 --- a/acl.c +++ b/acl.c @@ -95,13 +95,13 @@ int qemu_acl_party_is_allowed(qemu_acl *acl, =20 void qemu_acl_reset(qemu_acl *acl) { - qemu_acl_entry *entry; + qemu_acl_entry *entry, *next_entry; =20 /* Put back to deny by default, so there is no window * of "open access" while the user re-initializes the * access control list */ acl->defaultDeny =3D 1; - QTAILQ_FOREACH(entry, &acl->entries, next) { + QTAILQ_FOREACH_SAFE(entry, &acl->entries, next, next_entry) { QTAILQ_REMOVE(&acl->entries, entry, next); free(entry->match); free(entry); --=20 1.7.7