Skip to content

Commit

Permalink
io: avoid double-free when closing QIOChannelBuffer
Browse files Browse the repository at this point in the history
The QIOChannelBuffer's close implementation will free
the internal data buffer. It failed to reset the pointer
to NULL though, so when the object is later finalized
it will free it a second time with predictable crash.

Reviewed-by: Dr. David Alan Gilbert <[email protected]>
Signed-off-by: Daniel P. Berrange <[email protected]>
Reviewed-by: Juan Quintela <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Amit Shah <[email protected]>
  • Loading branch information
berrange authored and amit3s committed May 26, 2016
1 parent 1fd791f commit d656ec5
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions io/channel-buffer.c
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,7 @@ static int qio_channel_buffer_close(QIOChannel *ioc,
QIOChannelBuffer *bioc = QIO_CHANNEL_BUFFER(ioc);

g_free(bioc->data);
bioc->data = NULL;
bioc->capacity = bioc->usage = bioc->offset = 0;

return 0;
Expand Down

0 comments on commit d656ec5

Please sign in to comment.