diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2010-06-23 09:49:04 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2010-06-23 13:49:21 +0200 |
| commit | 899a9df0e6892c1cb5426949359ae6815914803a (patch) | |
| tree | b8b15004119c33606d162041200043f55ba6d8cb | |
| parent | b6efc72001bf15eb1f4d0adcf1afe6f1f9659c80 (diff) | |
| download | spice-899a9df0e6892c1cb5426949359ae6815914803a.tar.gz spice-899a9df0e6892c1cb5426949359ae6815914803a.tar.xz spice-899a9df0e6892c1cb5426949359ae6815914803a.zip | |
fix use-after-free in spice_marshaller_reset
| -rw-r--r-- | common/marshaller.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/common/marshaller.c b/common/marshaller.c index 5844b897..ece4f486 100644 --- a/common/marshaller.c +++ b/common/marshaller.c @@ -157,13 +157,14 @@ static void free_items(SpiceMarshaller *m) void spice_marshaller_reset(SpiceMarshaller *m) { - SpiceMarshaller *m2; + SpiceMarshaller *m2, *next; SpiceMarshallerData *d; /* Only supported for root marshaller */ assert(m->data->marshallers == m); - for (m2 = m; m2 != NULL; m2 = m2->next) { + for (m2 = m; m2 != NULL; m2 = next) { + next = m2->next; free_item_data(m2); /* Free non-root marshallers */ |