diff options
| author | Mark McLoughlin <markmc@redhat.com> | 2009-11-20 18:13:10 +0000 |
|---|---|---|
| committer | Aurelien Jarno <aurelien@aurel32.net> | 2009-11-21 00:34:04 +0100 |
| commit | d0c3e71da0331786b6699263128183c0a683d3bf (patch) | |
| tree | d071f240ab76c24f466571b6b4c8cb3a93175167 /slirp | |
| parent | 7958c5a80d46eb062e32b085347c460e706250a1 (diff) | |
| download | qemu-d0c3e71da0331786b6699263128183c0a683d3bf.tar.gz qemu-d0c3e71da0331786b6699263128183c0a683d3bf.tar.bz2 qemu-d0c3e71da0331786b6699263128183c0a683d3bf.zip | |
slirp: fix use-after-free
460fec67ee introduced a use-after free in slirp.
Cc: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Mark McLoughlin <markmc@redhat.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Diffstat (limited to 'slirp')
| -rw-r--r-- | slirp/mbuf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/slirp/mbuf.c b/slirp/mbuf.c index 7652fea196..87508ba013 100644 --- a/slirp/mbuf.c +++ b/slirp/mbuf.c @@ -95,8 +95,8 @@ m_free(struct mbuf *m) * Either free() it or put it on the free list */ if (m->m_flags & M_DOFREE) { - free(m); m->slirp->mbuf_alloced--; + free(m); } else if ((m->m_flags & M_FREELIST) == 0) { insque(m,&m->slirp->m_freelist); m->m_flags = M_FREELIST; /* Clobber other flags */ |