virsh: Fix segfault of snapshot-list

'snaps' is used after free()'ed.

diff --git a/tools/virsh-snapshot.c b/tools/virsh-snapshot.c
index b82837116ea22803549d1e91d6c519e08e39ef39..53de2b3addf8a4f3470e5c623acf7d0b79cd6c64 100644 (file)
--- a/tools/virsh-snapshot.c
+++ b/tools/virsh-snapshot.c
@@ -866,7 +866,7 @@ vshSnapshotListCollect(vshControl *ctl, virDomainPtr dom,
                     goto cleanup;
             }
             if (from) {
-                snaps[snaplist->nsnaps++] = from;
+                snaplist->snaps[snaplist->nsnaps++].snap = from;
                 virDomainSnapshotRef(from);
             }
         }