* [PATCH] ui/clipboard: fix use-after-free regression
@ 2022-02-14 11:59 marcandre.lureau
2022-02-14 12:02 ` Daniel P. Berrangé
0 siblings, 1 reply; 2+ messages in thread
From: marcandre.lureau @ 2022-02-14 11:59 UTC (permalink / raw)
To: qemu-devel; +Cc: Marc-André Lureau, berrange, kraxel
From: Marc-André Lureau <marcandre.lureau@redhat.com>
The same info may be used to update the clipboard, and may be freed
before being ref'ed again.
Fixes: 70a54b01693ed ("ui: avoid compiler warnings from unused clipboard info variable")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
ui/clipboard.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/ui/clipboard.c b/ui/clipboard.c
index 5f15cf853d07..9079ef829b51 100644
--- a/ui/clipboard.c
+++ b/ui/clipboard.c
@@ -66,8 +66,10 @@ void qemu_clipboard_update(QemuClipboardInfo *info)
notifier_list_notify(&clipboard_notifiers, ¬ify);
- qemu_clipboard_info_unref(cbinfo[info->selection]);
- cbinfo[info->selection] = qemu_clipboard_info_ref(info);
+ if (cbinfo[info->selection] != info) {
+ qemu_clipboard_info_unref(cbinfo[info->selection]);
+ cbinfo[info->selection] = qemu_clipboard_info_ref(info);
+ }
}
QemuClipboardInfo *qemu_clipboard_info(QemuClipboardSelection selection)
--
2.34.1.428.gdcc0cd074f0c
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] ui/clipboard: fix use-after-free regression
2022-02-14 11:59 [PATCH] ui/clipboard: fix use-after-free regression marcandre.lureau
@ 2022-02-14 12:02 ` Daniel P. Berrangé
0 siblings, 0 replies; 2+ messages in thread
From: Daniel P. Berrangé @ 2022-02-14 12:02 UTC (permalink / raw)
To: marcandre.lureau; +Cc: qemu-devel, kraxel
On Mon, Feb 14, 2022 at 03:59:17PM +0400, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
>
> The same info may be used to update the clipboard, and may be freed
> before being ref'ed again.
Ewww, subtle.
> Fixes: 70a54b01693ed ("ui: avoid compiler warnings from unused clipboard info variable")
>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
> ui/clipboard.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/ui/clipboard.c b/ui/clipboard.c
> index 5f15cf853d07..9079ef829b51 100644
> --- a/ui/clipboard.c
> +++ b/ui/clipboard.c
> @@ -66,8 +66,10 @@ void qemu_clipboard_update(QemuClipboardInfo *info)
>
> notifier_list_notify(&clipboard_notifiers, ¬ify);
>
> - qemu_clipboard_info_unref(cbinfo[info->selection]);
> - cbinfo[info->selection] = qemu_clipboard_info_ref(info);
> + if (cbinfo[info->selection] != info) {
> + qemu_clipboard_info_unref(cbinfo[info->selection]);
> + cbinfo[info->selection] = qemu_clipboard_info_ref(info);
> + }
> }
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-02-14 12:10 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-02-14 11:59 [PATCH] ui/clipboard: fix use-after-free regression marcandre.lureau
2022-02-14 12:02 ` Daniel P. Berrangé
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).