projects / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 16d2fc0) | patch
qiov: prevent double free or use-after-free
authorPaolo Bonzini <pbonzini@redhat.com>
Fri, 25 Nov 2011 11:06:22 +0000 (12:06 +0100)
committerKevin Wolf <kwolf@redhat.com>
Thu, 15 Dec 2011 11:40:33 +0000 (12:40 +0100)
commitbd83b3620517ef9f2079cfda465953e60263f623
treef9b07a82ad4e56215f022dc5a6142c32f87bd6d6tree | snapshot
parent16d2fc002a01cdd77e696ecc69de54db6720476acommit | diff
qiov: prevent double free or use-after-free

qemu_iovec_destroy does not clear the QEMUIOVector fully, and the data
could thus be used after free or freed again.  While I do not know any
example in the tree, I observed this using virtio-scsi (and SCSI
scatter/gather) when canceling DMA requests.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
cutils.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.