NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

stream: avoid use-after-free

Browse Source 
virFDStreamClose used a mutex after it was freed, and failed
to destroy that mutex on its last use.

* src/fdstream.c (virFDStreamFree): Inline into sole caller...
(virFDStreamClose): ...to avoid use-after-free and leak.
Reported by Matthias Bolte.
This commit is contained in:
Eric Blake 2011-05-13 13:32:00 -06:00
parent fbe3ab1a27
commit 34b999be42
1 changed files with 14 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
src/fdstream.c
View File

@ -210,9 +210,20 @@ cleanup:
return ret; return ret;
} }
static int virFDStreamFree(struct virFDStreamData *fdst)
static int
virFDStreamClose(virStreamPtr st)
{ {
struct virFDStreamData *fdst = st->privateData;
int ret; int ret;
VIR_DEBUG("st=%p", st);
if (!fdst)
return 0;
virMutexLock(&fdst->lock);
ret = VIR_CLOSE(fdst->fd); ret = VIR_CLOSE(fdst->fd);
if (fdst->cmd) { if (fdst->cmd) {
char buf[1024]; char buf[1024];
@ -243,29 +254,12 @@ static int virFDStreamFree(struct virFDStreamData *fdst)
} }
virCommandFree(fdst->cmd); virCommandFree(fdst->cmd);
} }
VIR_FREE(fdst);
return ret;
}
static int
virFDStreamClose(virStreamPtr st)
{
struct virFDStreamData *fdst = st->privateData;
int ret;
VIR_DEBUG("st=%p", st);
if (!fdst)
return 0;
virMutexLock(&fdst->lock);
ret = virFDStreamFree(fdst);
st->privateData = NULL; st->privateData = NULL;
virMutexUnlock(&fdst->lock); virMutexUnlock(&fdst->lock);
virMutexDestroy(&fdst->lock);
VIR_FREE(fdst);
return ret; return ret;
} }