aboutsummaryrefslogtreecommitdiff
path: root/slirp/mbuf.c
diff options
context:
space:
mode:
authorMark McLoughlin <markmc@redhat.com>2009-11-20 18:13:10 +0000
committerAurelien Jarno <aurelien@aurel32.net>2009-11-21 00:34:04 +0100
commite0cf6d15e374c8db39acda551845ecc62f5205a3 (patch)
treed071f240ab76c24f466571b6b4c8cb3a93175167 /slirp/mbuf.c
parentf7c703250cef231085f07352b719bb91d71ea8a1 (diff)
downloadqemu-e0cf6d15e374c8db39acda551845ecc62f5205a3.zip
qemu-e0cf6d15e374c8db39acda551845ecc62f5205a3.tar.gz
qemu-e0cf6d15e374c8db39acda551845ecc62f5205a3.tar.bz2
slirp: fix use-after-free
460fec67ee introduced a use-after free in slirp. Cc: Jan Kiszka <jan.kiszka@siemens.com> Signed-off-by: Mark McLoughlin <markmc@redhat.com> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Diffstat (limited to 'slirp/mbuf.c')
-rw-r--r--slirp/mbuf.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/slirp/mbuf.c b/slirp/mbuf.c
index 7652fea..87508ba 100644
--- a/slirp/mbuf.c
+++ b/slirp/mbuf.c
@@ -95,8 +95,8 @@ m_free(struct mbuf *m)
* Either free() it or put it on the free list
*/
if (m->m_flags & M_DOFREE) {
- free(m);
m->slirp->mbuf_alloced--;
+ free(m);
} else if ((m->m_flags & M_FREELIST) == 0) {
insque(m,&m->slirp->m_freelist);
m->m_flags = M_FREELIST; /* Clobber other flags */