On Fri, Mar 16, 2012 at 08:16:12PM +0100, Laszlo Ersek wrote:
> Stack entries in QmpOutputVisitor are navigation links (weak references),
> except the bottom (ie. least recently added) entry, which owns the root
> QObject [1]. Make qmp_output_visitor_cleanup() drop the stack entries,
> then release the QObject tree by the root.
>
> Attempting to serialize an invalid enum inside a dictionary is an example
> for triggering the double free.
>
> [1] http://lists.nongnu.org/archive/html/qemu-devel/2012-03/msg03276.html
>
> Signed-off-by: Laszlo Ersek <ler...@redhat.com>
Tested-by: Michael Roth <mdr...@linux.vnet.ibm.com>
Looks good. Did you or Paolo want to re-send that test case with a SoB?
I have a test case that triggers this by manually calling error_set(),
but I think yours is better.
> ---
> qapi/qmp-output-visitor.c | 8 +++++---
> 1 files changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/qapi/qmp-output-visitor.c b/qapi/qmp-output-visitor.c
> index e0697b0..2bce9d5 100644
> --- a/qapi/qmp-output-visitor.c
> +++ b/qapi/qmp-output-visitor.c
> @@ -199,14 +199,16 @@ void qmp_output_visitor_cleanup(QmpOutputVisitor *v)
> {
> QStackEntry *e, *tmp;
>
> + /* The bottom QStackEntry, if any, owns the root QObject. See the
> + * qmp_output_push_obj() invocations in qmp_output_add_obj(). */
> + QObject *root = QTAILQ_EMPTY(&v->stack) ? NULL : qmp_output_first(v);
> +
> QTAILQ_FOREACH_SAFE(e, &v->stack, node, tmp) {
> QTAILQ_REMOVE(&v->stack, e, node);
> - if (e->value) {
> - qobject_decref(e->value);
> - }
> g_free(e);
> }
>
> + qobject_decref(root);
> g_free(v);
> }
>
> --
> 1.7.1
>
