haraldwolff
/
qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

qiov: prevent double free or use-after-free 

qemu_iovec_destroy does not clear the QEMUIOVector fully, and the data
could thus be used after free or freed again.  While I do not know any
example in the tree, I observed this using virtio-scsi (and SCSI
scatter/gather) when canceling DMA requests.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
stable-1.1
Paolo Bonzini 2011-11-25 12:06:22 +01:00 committed by Kevin Wolf
parent 16d2fc002a
commit bd83b36205
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
cutils.c
View File

@ -217,7 +217,10 @@ void qemu_iovec_destroy(QEMUIOVector *qiov)
{
assert(qiov->nalloc != -1);
qemu_iovec_reset(qiov);
g_free(qiov->iov);
qiov->nalloc = 0;
qiov->iov = NULL;
}
void qemu_iovec_reset(QEMUIOVector *qiov)