aboutsummaryrefslogtreecommitdiff
path: root/net/colo.c
diff options
context:
space:
mode:
authorzhanghailiang <zhang.zhanghailiang@huawei.com>2017-02-28 11:54:18 +0800
committerJason Wang <jasowang@redhat.com>2017-03-06 11:46:02 +0800
commit0e79668e1ffcfabb259bea6c2a2bae00a6b27252 (patch)
tree530745cf641ca07f3d93720fb6f782c9373024c9 /net/colo.c
parenta11f5cb005f9854f0d78da97fc23adf5bc8c83f3 (diff)
downloadqemu-0e79668e1ffcfabb259bea6c2a2bae00a6b27252.zip
qemu-0e79668e1ffcfabb259bea6c2a2bae00a6b27252.tar.gz
qemu-0e79668e1ffcfabb259bea6c2a2bae00a6b27252.tar.bz2
net/colo: fix memory double free error
The 'primary_list' and 'secondary_list' members of struct Connection is not allocated through dynamically g_queue_new(), but we free it by using g_queue_free(), which will lead to a double-free bug. Reviewed-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com> Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'net/colo.c')
-rw-r--r--net/colo.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/colo.c b/net/colo.c
index 6a6eacd..8cc166b 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -147,9 +147,9 @@ void connection_destroy(void *opaque)
Connection *conn = opaque;
g_queue_foreach(&conn->primary_list, packet_destroy, NULL);
- g_queue_free(&conn->primary_list);
+ g_queue_clear(&conn->primary_list);
g_queue_foreach(&conn->secondary_list, packet_destroy, NULL);
- g_queue_free(&conn->secondary_list);
+ g_queue_clear(&conn->secondary_list);
g_slice_free(Connection, conn);
}