From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Daley Subject: [PATCH 3/8] libxl: fix use-after-free in discard_events iteration Date: Wed, 11 Sep 2013 02:34:17 +1200 Message-ID: <1378823662-20803-4-git-send-email-mattjd@gmail.com> References: <1378823662-20803-1-git-send-email-mattjd@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1378823662-20803-1-git-send-email-mattjd@gmail.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xen.org Cc: Matthew Daley , Ian Jackson , Ian Campbell , Stefano Stabellini List-Id: xen-devel@lists.xenproject.org We need to use the foreach variant which gets the next pointer before the loop body is executed. Coverity-ID: 1056193 Signed-off-by: Matthew Daley --- tools/libxl/libxl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c index 81785df..8f4a250 100644 --- a/tools/libxl/libxl.c +++ b/tools/libxl/libxl.c @@ -122,8 +122,8 @@ static void free_disable_deaths(libxl__gc *gc, static void discard_events(struct libxl__event_list *l) { /* doesn't bother unlinking from the list, so l is corrupt on return */ - libxl_event *ev; - LIBXL_TAILQ_FOREACH(ev, l, link) + libxl_event *ev, *next; + LIBXL_TAILQ_FOREACH_SAFE(ev, l, link, next) libxl_event_free(0, ev); } -- 1.7.10.4