summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGerd Hoffmann <kraxel@redhat.com>2010-06-23 09:49:04 +0200
committerGerd Hoffmann <kraxel@redhat.com>2010-06-23 13:49:21 +0200
commit899a9df0e6892c1cb5426949359ae6815914803a (patch)
treeb8b15004119c33606d162041200043f55ba6d8cb
parentb6efc72001bf15eb1f4d0adcf1afe6f1f9659c80 (diff)
downloadspice-899a9df0e6892c1cb5426949359ae6815914803a.tar.gz
spice-899a9df0e6892c1cb5426949359ae6815914803a.tar.xz
spice-899a9df0e6892c1cb5426949359ae6815914803a.zip
fix use-after-free in spice_marshaller_reset
-rw-r--r--common/marshaller.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/common/marshaller.c b/common/marshaller.c
index 5844b897..ece4f486 100644
--- a/common/marshaller.c
+++ b/common/marshaller.c
@@ -157,13 +157,14 @@ static void free_items(SpiceMarshaller *m)
void spice_marshaller_reset(SpiceMarshaller *m)
{
- SpiceMarshaller *m2;
+ SpiceMarshaller *m2, *next;
SpiceMarshallerData *d;
/* Only supported for root marshaller */
assert(m->data->marshallers == m);
- for (m2 = m; m2 != NULL; m2 = m2->next) {
+ for (m2 = m; m2 != NULL; m2 = next) {
+ next = m2->next;
free_item_data(m2);
/* Free non-root marshallers */