| Message ID | 1487735198-127300-2-git-send-email-zhang.zhanghailiang@huawei.com |
|---|---|
| State | New |
| Headers | show |
On 02/22/2017 11:46 AM, zhanghailiang wrote: > The 'primary_list' and 'secondary_list' members of struct Connection > is not allocated through dynamically g_queue_new(), but we free it by using > g_queue_free(), which will lead to a double-free bug. > > Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Reviewed-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com> > --- > net/colo.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/net/colo.c b/net/colo.c > index 6a6eacd..8cc166b 100644 > --- a/net/colo.c > +++ b/net/colo.c > @@ -147,9 +147,9 @@ void connection_destroy(void *opaque) > Connection *conn = opaque; > > g_queue_foreach(&conn->primary_list, packet_destroy, NULL); > - g_queue_free(&conn->primary_list); > + g_queue_clear(&conn->primary_list); > g_queue_foreach(&conn->secondary_list, packet_destroy, NULL); > - g_queue_free(&conn->secondary_list); > + g_queue_clear(&conn->secondary_list); > g_slice_free(Connection, conn); > } >
diff --git a/net/colo.c b/net/colo.c index 6a6eacd..8cc166b 100644 --- a/net/colo.c +++ b/net/colo.c @@ -147,9 +147,9 @@ void connection_destroy(void *opaque) Connection *conn = opaque; g_queue_foreach(&conn->primary_list, packet_destroy, NULL); - g_queue_free(&conn->primary_list); + g_queue_clear(&conn->primary_list); g_queue_foreach(&conn->secondary_list, packet_destroy, NULL); - g_queue_free(&conn->secondary_list); + g_queue_clear(&conn->secondary_list); g_slice_free(Connection, conn); }
The 'primary_list' and 'secondary_list' members of struct Connection is not allocated through dynamically g_queue_new(), but we free it by using g_queue_free(), which will lead to a double-free bug. Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> --- net/colo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)