From: Matthew Daley <mattjd@gmail.com>
Date: Tue, 10 Sep 2013 14:34:19 +0000 (+1200)
Subject: mini-os: fix use-after-free in xs_daemon_close event iteration
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=5307cc892d66d39d80bf70f1284d827047285673;p=people%2Fliuw%2Flibxenctrl-split%2Fmini-os.git

mini-os: fix use-after-free in xs_daemon_close event iteration

We need to get the next pointer before the freeing of the event.

Coverity-ID: 1056173
Signed-off-by: Matthew Daley <mattjd@gmail.com>
Acked-By: Samuel Thibault <samuel.thibault@ens-lyon.org>
---

diff --git a/lib/xs.c b/lib/xs.c
index a2a1220..c603d17 100644
--- a/lib/xs.c
+++ b/lib/xs.c
@@ -29,9 +29,12 @@ struct xs_handle *xs_daemon_open()
 void xs_daemon_close(struct xs_handle *h)
 {
     int fd = _xs_fileno(h);
-    struct xenbus_event *event;
-    for (event = files[fd].xenbus.events; event; event = event->next)
+    struct xenbus_event *event, *next;
+    for (event = files[fd].xenbus.events; event; event = next)
+    {
+        next = event->next;
         free(event);
+    }
     files[fd].type = FTYPE_NONE;
 }