[Xen-changelog] [xen master] mini-os: fix use-after-free in xs_daemon_close event iteration

[patchbot@xxxxxxx]

commit 72b9c3e88c1cd205b39b178ce5e684868a1117c2
Author:     Matthew Daley <mattjd@xxxxxxxxx>
AuthorDate: Wed Sep 11 02:34:19 2013 +1200
Commit:     Ian Campbell <ian.campbell@xxxxxxxxxx>
CommitDate: Fri Sep 13 13:14:51 2013 +0100

    mini-os: fix use-after-free in xs_daemon_close event iteration
    
    We need to get the next pointer before the freeing of the event.
    
    Coverity-ID: 1056173
    Signed-off-by: Matthew Daley <mattjd@xxxxxxxxx>
    Acked-By: Samuel Thibault <samuel.thibault@xxxxxxxxxxxx>
---
 extras/mini-os/lib/xs.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/extras/mini-os/lib/xs.c b/extras/mini-os/lib/xs.c
index a2a1220..c603d17 100644
--- a/extras/mini-os/lib/xs.c
+++ b/extras/mini-os/lib/xs.c
@@ -29,9 +29,12 @@ struct xs_handle *xs_daemon_open()
 void xs_daemon_close(struct xs_handle *h)
 {
     int fd = _xs_fileno(h);
-    struct xenbus_event *event;
-    for (event = files[fd].xenbus.events; event; event = event->next)
+    struct xenbus_event *event, *next;
+    for (event = files[fd].xenbus.events; event; event = next)
+    {
+        next = event->next;
         free(event);
+    }
     files[fd].type = FTYPE_NONE;
 }
 
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog