32 lines
900 B
Diff
32 lines
900 B
Diff
From 56d370091cb01878c580f528011cd1717f8077fa Mon Sep 17 00:00:00 2001
|
|
From: Mark McLoughlin <markmc@redhat.com>
|
|
Date: Fri, 20 Nov 2009 18:07:15 +0000
|
|
Subject: [PATCH] slirp: fix use-after-free
|
|
|
|
460fec67ee introduced a use-after free in slirp.
|
|
|
|
Cc: Jan Kiszka <jan.kiszka@siemens.com>
|
|
Signed-off-by: Mark McLoughlin <markmc@redhat.com>
|
|
Fedora-patch: qemu-slirp-use-after-free.patch
|
|
---
|
|
slirp/mbuf.c | 2 +-
|
|
1 files changed, 1 insertions(+), 1 deletions(-)
|
|
|
|
diff --git a/slirp/mbuf.c b/slirp/mbuf.c
|
|
index 7652fea..87508ba 100644
|
|
--- a/slirp/mbuf.c
|
|
+++ b/slirp/mbuf.c
|
|
@@ -95,8 +95,8 @@ m_free(struct mbuf *m)
|
|
* Either free() it or put it on the free list
|
|
*/
|
|
if (m->m_flags & M_DOFREE) {
|
|
- free(m);
|
|
m->slirp->mbuf_alloced--;
|
|
+ free(m);
|
|
} else if ((m->m_flags & M_FREELIST) == 0) {
|
|
insque(m,&m->slirp->m_freelist);
|
|
m->m_flags = M_FREELIST; /* Clobber other flags */
|
|
--
|
|
1.6.2.5
|
|
|