The 'primary_list' and 'secondary_list' members of struct Connection
is not allocated through dynamically g_queue_new(), but we free it by using
g_queue_free(), which will lead to a double-free bug.
Signed-off-by: zhanghailiang <zhang.zhanghaili...@huawei.com>
---
net/colo.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/net/colo.c b/net/colo.c
index 6a6eacd..7d5c423 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -147,9 +147,7 @@ void connection_destroy(void *opaque)
Connection *conn = opaque;
g_queue_foreach(&conn->primary_list, packet_destroy, NULL);
- g_queue_free(&conn->primary_list);
g_queue_foreach(&conn->secondary_list, packet_destroy, NULL);
- g_queue_free(&conn->secondary_list);
g_slice_free(Connection, conn);
}
--
1.8.3.1
