diff options
| author | Greg Kurz <groug@kaod.org> | 2017-09-12 20:48:05 +0200 |
|---|---|---|
| committer | David Gibson <david@gibson.dropbear.id.au> | 2017-09-15 10:29:48 +1000 |
| commit | d492a75cfefd9a09125ba2b007c817c1417c3820 (patch) | |
| tree | bd9059e23f6f2febf520f2de6fe70ac1936dc07b | |
| parent | 3b2fcedd52986db92fd17127c73d9c09d4ae2da1 (diff) | |
| download | qemu-d492a75cfefd9a09125ba2b007c817c1417c3820.zip qemu-d492a75cfefd9a09125ba2b007c817c1417c3820.tar.gz qemu-d492a75cfefd9a09125ba2b007c817c1417c3820.tar.bz2 | |
spapr_events: use QTAILQ_FOREACH_SAFE() in spapr_clear_pending_events()
QTAILQ_FOREACH_SAFE() must be used when removing the current element
inside the loop block.
This fixes a user-after-free error introduced by commit 56258174238eb
and reported by Coverity (CID 1381017).
Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| -rw-r--r-- | hw/ppc/spapr_events.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c index 66b8164..e377fc7 100644 --- a/hw/ppc/spapr_events.c +++ b/hw/ppc/spapr_events.c @@ -702,9 +702,9 @@ static void event_scan(PowerPCCPU *cpu, sPAPRMachineState *spapr, void spapr_clear_pending_events(sPAPRMachineState *spapr) { - sPAPREventLogEntry *entry = NULL; + sPAPREventLogEntry *entry = NULL, *next_entry; - QTAILQ_FOREACH(entry, &spapr->pending_events, next) { + QTAILQ_FOREACH_SAFE(entry, &spapr->pending_events, next, next_entry) { QTAILQ_REMOVE(&spapr->pending_events, entry, next); g_free(entry->extended_log); g_free(entry); |