]> xenbits.xensource.com Git - libvirt.git/commit
Avoid use of free'd memory in auto destroy callback
authorDaniel P. Berrange <berrange@redhat.com>
Wed, 23 Jan 2013 17:22:27 +0000 (17:22 +0000)
committerDaniel P. Berrange <berrange@redhat.com>
Thu, 24 Jan 2013 14:13:26 +0000 (14:13 +0000)
commit4e4c6620e2e2937da03d37720d39368d297f5743
tree3eb6df6c7f094c1675f87a5fb9a760afdbc47022
parent83b4137d41a4f0dbf18ccd6bb2e86ef7cb59686d
Avoid use of free'd memory in auto destroy callback

The autodestroy callback code has the following function
called from a hash iterator

  qemuDriverCloseCallbackRun(void *payload,
                             const void *name,
                             void *opaque)
  {
    ...
    char *uuidstr = name
    ...

    dom = closeDef->cb(data->driver, dom, data->conn);
    if (dom)
        virObjectUnlock(dom);

    virHashRemoveEntry(data->driver->closeCallbacks, uuidstr);
  }

The closeDef->cb function may well cause the current callback
to be removed, if it shuts down 'dom'. As such the use of
'uuidstr' in virHashRemoveEntry is accessing free'd memory.
We must make a copy of the uuid str before invoking the
callback to be safe.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
src/qemu/qemu_conf.c