From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Daley Subject: [PATCH 5/8] mini-os: fix use-after-free in xs_daemon_close event iteration Date: Wed, 11 Sep 2013 02:34:19 +1200 Message-ID: <1378823662-20803-6-git-send-email-mattjd@gmail.com> References: <1378823662-20803-1-git-send-email-mattjd@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1378823662-20803-1-git-send-email-mattjd@gmail.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xen.org Cc: Samuel Thibault , Matthew Daley , Stefano Stabellini List-Id: xen-devel@lists.xenproject.org We need to get the next pointer before the freeing of the event. Coverity-ID: 1056173 Signed-off-by: Matthew Daley --- extras/mini-os/lib/xs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/extras/mini-os/lib/xs.c b/extras/mini-os/lib/xs.c index a2a1220..c603d17 100644 --- a/extras/mini-os/lib/xs.c +++ b/extras/mini-os/lib/xs.c @@ -29,9 +29,12 @@ struct xs_handle *xs_daemon_open() void xs_daemon_close(struct xs_handle *h) { int fd = _xs_fileno(h); - struct xenbus_event *event; - for (event = files[fd].xenbus.events; event; event = event->next) + struct xenbus_event *event, *next; + for (event = files[fd].xenbus.events; event; event = next) + { + next = event->next; free(event); + } files[fd].type = FTYPE_NONE; } -- 1.7.10.4