mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events()

Browse Source 
QTAILQ_FOREACH_SAFE() must be used when removing the current element
inside the loop block.

This fixes a user-after-free error introduced by commit 5625817423
and reported by Coverity (CID 1381017).

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
This commit is contained in:
Greg Kurz 2017-09-12 20:48:05 +02:00 committed by David Gibson
parent 3b2fcedd52
commit d492a75cfe
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hw/ppc/spapr_events.c
View File

@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineState *spapr,
void spapr_clear_pending_events(sPAPRMachineState *spapr)
{
sPAPREventLogEntry *entry = NULL;
sPAPREventLogEntry *entry = NULL, *next_entry;
QTAILQ_FOREACH(entry, &spapr->pending_events, next) {
QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) {
QTAILQ_REMOVE(&spapr->pending_events, entry, next);
g_free(entry->extended_log);
g_free(entry);