diff options
author | Daniel P. Berrange <berrange@redhat.com> | 2017-01-25 11:10:53 +0000 |
---|---|---|
committer | Daniel P. Berrange <berrange@redhat.com> | 2017-01-26 10:26:18 +0000 |
commit | 80fb34eda099e7cc519a91e9701ab3c0262717b3 (patch) | |
tree | 44fc2cdb60950b04588b6ad65651b353170ae04b /io | |
parent | c7f1cf01b8245762ca5864e835d84f6677ae8b1f (diff) | |
download | qemu-80fb34eda099e7cc519a91e9701ab3c0262717b3.zip qemu-80fb34eda099e7cc519a91e9701ab3c0262717b3.tar.gz qemu-80fb34eda099e7cc519a91e9701ab3c0262717b3.tar.bz2 |
io: fix possible double free of task error object
If a QIOTask has an error set and the calling code uses
qio_task_propagate_error() to steal the reference to
that Error object, the task would not clear its own
reference. This would lead to a double-free when
qio_task_free runs, if the caller had (correctly) freed
the Error object they now owned.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Diffstat (limited to 'io')
-rw-r--r-- | io/task.c | 1 |
1 files changed, 1 insertions, 0 deletions
@@ -157,6 +157,7 @@ bool qio_task_propagate_error(QIOTask *task, { if (task->err) { error_propagate(errp, task->err); + task->err = NULL; return true; } |