[Spice-devel] [PATCH] fix use-after-free in spice_marshaller_reset

[Alexander Larsson]

On Wed, 2010-06-23 at 09:53 +0200, Gerd Hoffmann wrote:
> ---
>  common/marshaller.c |    5 +++--
>  1 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/common/marshaller.c b/common/marshaller.c
> index 5844b89..ece4f48 100644
> --- a/common/marshaller.c
> +++ b/common/marshaller.c
> @@ -157,13 +157,14 @@ static void free_items(SpiceMarshaller *m)
>  
>  void spice_marshaller_reset(SpiceMarshaller *m)
>  {
> -    SpiceMarshaller *m2;
> +    SpiceMarshaller *m2, *next;
>      SpiceMarshallerData *d;
>  
>      /* Only supported for root marshaller */
>      assert(m->data->marshallers == m);
>  
> -    for (m2 = m; m2 != NULL; m2 = m2->next) {
> +    for (m2 = m; m2 != NULL; m2 = next) {
> +        next = m2->next;
>          free_item_data(m2);
>  
>          /* Free non-root marshallers */

Ack, please commit

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 Alexander Larsson                                            Red Hat, Inc 
       alexl at redhat.com            alexander.larsson at gmail.com 
He's a scrappy dishevelled shaman moving from town to town, helping folk in 
trouble. She's a disco-crazy cigar-chomping femme fatale operating on the 
wrong side of the law. They fight crime!