From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54759) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1agvQv-0007sC-SE for qemu-devel@nongnu.org; Fri, 18 Mar 2016 10:31:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1agvQr-0001uy-Vz for qemu-devel@nongnu.org; Fri, 18 Mar 2016 10:31:21 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60696) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1agvQr-0001uE-Qr for qemu-devel@nongnu.org; Fri, 18 Mar 2016 10:31:17 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (Postfix) with ESMTPS id 7FF0E8E3CA for ; Fri, 18 Mar 2016 14:31:17 +0000 (UTC) From: "Daniel P. Berrange" Date: Fri, 18 Mar 2016 14:30:37 +0000 Message-Id: <1458311463-28272-3-git-send-email-berrange@redhat.com> In-Reply-To: <1458311463-28272-1-git-send-email-berrange@redhat.com> References: <1458311463-28272-1-git-send-email-berrange@redhat.com> Subject: [Qemu-devel] [PATCH v5 02/28] io: avoid double-free when closing QIOChannelBuffer List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Amit Shah , "Dr. David Alan Gilbert" , Juan Quintela The QIOChannelBuffer's close implementation will free the internal data buffer. It failed to reset the pointer to NULL though, so when the object is later finalized it will free it a second time with predictable crash. Signed-off-by: Daniel P. Berrange --- io/channel-buffer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/io/channel-buffer.c b/io/channel-buffer.c index 3e5117b..43d7959 100644 --- a/io/channel-buffer.c +++ b/io/channel-buffer.c @@ -140,6 +140,7 @@ static int qio_channel_buffer_close(QIOChannel *ioc, QIOChannelBuffer *bioc = QIO_CHANNEL_BUFFER(ioc); g_free(bioc->data); + bioc->data = NULL; bioc->capacity = bioc->usage = bioc->offset = 0; return 0; -- 2.5.0