diff options
| author | Matthew Daley <mattjd@gmail.com> | 2013-09-11 02:34:17 +1200 |
|---|---|---|
| committer | Ian Campbell <ian.campbell@citrix.com> | 2013-09-13 13:14:37 +0100 |
| commit | ceb556178d59d6e06871b1b921e5c8b9be084582 (patch) | |
| tree | 50bc81908fa873251a094396cd9b0b1494fc01f9 /tools | |
| parent | a508caf0ebc4f834bd44c1d607e5b7bfabe43e3d (diff) | |
| download | xen-ceb556178d59d6e06871b1b921e5c8b9be084582.tar.gz xen-ceb556178d59d6e06871b1b921e5c8b9be084582.tar.bz2 xen-ceb556178d59d6e06871b1b921e5c8b9be084582.zip | |
libxl: fix use-after-free in discard_events iteration
We need to use the foreach variant which gets the next pointer before
the loop body is executed.
Coverity-ID: 1056193
Signed-off-by: Matthew Daley <mattjd@gmail.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/libxl/libxl.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c index 7a7aaf90fe..0879f2331f 100644 --- a/tools/libxl/libxl.c +++ b/tools/libxl/libxl.c @@ -122,8 +122,8 @@ static void free_disable_deaths(libxl__gc *gc, static void discard_events(struct libxl__event_list *l) { /* doesn't bother unlinking from the list, so l is corrupt on return */ - libxl_event *ev; - LIBXL_TAILQ_FOREACH(ev, l, link) + libxl_event *ev, *next; + LIBXL_TAILQ_FOREACH_SAFE(ev, l, link, next) libxl_event_free(0, ev); } |