From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40374) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XEuWt-00058D-Vj for qemu-devel@nongnu.org; Wed, 06 Aug 2014 02:17:00 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XEuWp-0006Ku-5t for qemu-devel@nongnu.org; Wed, 06 Aug 2014 02:16:55 -0400 Received: from szxga02-in.huawei.com ([119.145.14.65]:14034) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XEuWo-0006Ka-7e for qemu-devel@nongnu.org; Wed, 06 Aug 2014 02:16:51 -0400 From: zhanghailiang Date: Wed, 6 Aug 2014 14:15:56 +0800 Message-ID: <1407305758-13108-3-git-send-email-zhang.zhanghailiang@huawei.com> In-Reply-To: <1407305758-13108-1-git-send-email-zhang.zhanghailiang@huawei.com> References: <1407305758-13108-1-git-send-email-zhang.zhanghailiang@huawei.com> MIME-Version: 1.0 Content-Type: text/plain Subject: [Qemu-devel] [PATCH v2 2/4] monitor: fix access freed memory List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, stefanha@redhat.com, mst@redhat.com, luonengjun@huawei.com, peter.huangpeng@huawei.com, lcapitulino@redhat.com, alex@alex.org.uk, pbonzini@redhat.com, alex.bennee@linaro.org, zhanghailiang The function monitor_fdset_dup_fd_find_remove() references member of 'mon_fdset' which may be freed in function monitor_fdset_cleanup() Signed-off-by: zhanghailiang --- monitor.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/monitor.c b/monitor.c index 5bc70a6..41e46a6 100644 --- a/monitor.c +++ b/monitor.c @@ -2532,8 +2532,10 @@ static int monitor_fdset_dup_fd_find_remove(int dup_fd, bool remove) { MonFdset *mon_fdset; MonFdsetFd *mon_fdset_fd_dup; + int64_t id = -1; QLIST_FOREACH(mon_fdset, &mon_fdsets, next) { + id = mon_fdset->id; QLIST_FOREACH(mon_fdset_fd_dup, &mon_fdset->dup_fds, next) { if (mon_fdset_fd_dup->fd == dup_fd) { if (remove) { @@ -2542,7 +2544,7 @@ static int monitor_fdset_dup_fd_find_remove(int dup_fd, bool remove) monitor_fdset_cleanup(mon_fdset); } } - return mon_fdset->id; + return id; } } } -- 1.7.12.4