From patchwork Fri Nov 20 18:13:10 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: slirp: fix use-after-free Date: Fri, 20 Nov 2009 08:13:10 -0000 From: Mark McLoughlin X-Patchwork-Id: 38934 Message-Id: <1258740790-26036-1-git-send-email-markmc@redhat.com> To: qemu-devel@nongnu.org Cc: Mark McLoughlin , Jan Kiszka 460fec67ee introduced a use-after free in slirp. Cc: Jan Kiszka Signed-off-by: Mark McLoughlin --- Untested fix, but it's obvious. Also, this is needed on stable-0.11. slirp/mbuf.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/slirp/mbuf.c b/slirp/mbuf.c index 7652fea..87508ba 100644 --- a/slirp/mbuf.c +++ b/slirp/mbuf.c @@ -95,8 +95,8 @@ m_free(struct mbuf *m) * Either free() it or put it on the free list */ if (m->m_flags & M_DOFREE) { - free(m); m->slirp->mbuf_alloced--; + free(m); } else if ((m->m_flags & M_FREELIST) == 0) { insque(m,&m->slirp->m_freelist); m->m_flags = M_FREELIST; /* Clobber other flags */