diff options
| author | Samuel Thibault <samuel.thibault@ens-lyon.org> | 2016-11-13 23:54:27 +0100 |
|---|---|---|
| committer | Samuel Thibault <samuel.thibault@ens-lyon.org> | 2016-11-14 17:36:33 +0100 |
| commit | ea64d5f08817b5e79e17135dce516c7583107f91 (patch) | |
| tree | a408d75f89b8237cbde64097a854ffc4f442922f /slirp/dhcpv6.c | |
| parent | 83c83f9a5266ff113060f887f106a47920fa6974 (diff) | |
| download | qemu-ea64d5f08817b5e79e17135dce516c7583107f91.zip qemu-ea64d5f08817b5e79e17135dce516c7583107f91.tar.gz qemu-ea64d5f08817b5e79e17135dce516c7583107f91.tar.bz2 | |
slirp: Fix access to freed memory
if_start() goes through the slirp->if_fastq and slirp->if_batchq
list of pending messages, and accesses ifm->ifq_so->so_nqueued of its
elements if ifm->ifq_so != NULL. When freeing a socket, we thus need
to make sure that any pending message for this socket does not refer
to the socket any more.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Tested-by: Brian Candler <b.candler@pobox.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'slirp/dhcpv6.c')
0 files changed, 0 insertions, 0 deletions