On 01/23/2013 10:25 AM, Daniel P. Berrange wrote: > From: "Daniel P. Berrange" <[email protected]> > > The autodestroy callback code has the following function > called from a hash iterator > > qemuDriverCloseCallbackRun(void *payload, > const void *name, > void *opaque) > { > ... > char *uuidstr = name > ... > > dom = closeDef->cb(data->driver, dom, data->conn); > if (dom) > virObjectUnlock(dom); > > virHashRemoveEntry(data->driver->closeCallbacks, uuidstr); > } > > The closeDef->cb function may well cause the current callback > to be removed, if it shuts down 'dom'. As such the use of > 'uuidstr' in virHashRemoveEntry is accessing free'd memory. > We must make a copy of the uuid str before invoking the > callback to be safe. > > Signed-off-by: Daniel P. Berrange <[email protected]> > --- > src/qemu/qemu_conf.c | 13 +++++++++---- > 1 file changed, 9 insertions(+), 4 deletions(-)
ACK. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/libvir-list
