[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-changelog] [xen master] libxl: fix use-after-free in discard_events iteration

commit ceb556178d59d6e06871b1b921e5c8b9be084582
Author:     Matthew Daley <mattjd@xxxxxxxxx>
AuthorDate: Wed Sep 11 02:34:17 2013 +1200
Commit:     Ian Campbell <ian.campbell@xxxxxxxxxx>
CommitDate: Fri Sep 13 13:14:37 2013 +0100

    libxl: fix use-after-free in discard_events iteration
    We need to use the foreach variant which gets the next pointer before
    the loop body is executed.
    Coverity-ID: 1056193
    Signed-off-by: Matthew Daley <mattjd@xxxxxxxxx>
    Acked-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
 tools/libxl/libxl.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c
index 7a7aaf9..0879f23 100644
--- a/tools/libxl/libxl.c
+++ b/tools/libxl/libxl.c
@@ -122,8 +122,8 @@ static void free_disable_deaths(libxl__gc *gc,
 static void discard_events(struct libxl__event_list *l) {
     /* doesn't bother unlinking from the list, so l is corrupt on return */
-    libxl_event *ev;
-    LIBXL_TAILQ_FOREACH(ev, l, link)
+    libxl_event *ev, *next;
+    LIBXL_TAILQ_FOREACH_SAFE(ev, l, link, next)
         libxl_event_free(0, ev);
generated by git-patchbot for /home/xen/git/xen.git#master

Xen-changelog mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.