diff options
author | Steven Luo <steven+qemu@steven676.net> | 2016-04-06 22:04:32 -0700 |
---|---|---|
committer | Samuel Thibault <samuel.thibault@ens-lyon.org> | 2016-04-07 10:27:42 +0200 |
commit | cbe476c8f001e1757c8fcd7f49ee7b51caf4e0da (patch) | |
tree | 18699161edb6f053197e355f3dc1dd3e9e8ce1ea /socket.h | |
parent | 804f441a9d6998a57040bf36685a17a6436b2ea8 (diff) | |
download | slirp-cbe476c8f001e1757c8fcd7f49ee7b51caf4e0da.zip slirp-cbe476c8f001e1757c8fcd7f49ee7b51caf4e0da.tar.gz slirp-cbe476c8f001e1757c8fcd7f49ee7b51caf4e0da.tar.bz2 |
slirp: avoid use-after-free in slirp_pollfds_poll() if soread() returns an error
Samuel Thibault pointed out that it's possible that slirp_pollfds_poll()
will try to use a socket even after soread() returns an error, resulting
in an use-after-free if the socket was removed while handling the error.
Avoid this by refusing to continue to work with the socket in this case.
Signed-off-by: Steven Luo <steven+qemu@steven676.net>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Diffstat (limited to 'socket.h')
-rw-r--r-- | socket.h | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -132,7 +132,7 @@ struct socket *solookup(struct socket **, struct socket *, struct socket *socreate(Slirp *); void sofree(struct socket *); int soread(struct socket *); -void sorecvoob(struct socket *); +int sorecvoob(struct socket *); int sosendoob(struct socket *); int sowrite(struct socket *); void sorecvfrom(struct socket *); |