[Spice-commits] server/char-device.c

[Frediano Ziglio]

 server/char-device.c |    1 +
 1 file changed, 1 insertion(+)

New commits:
commit fe3d5d542d867a1d4da331035a60403bf7289998
Author: Christophe Fergeau <cfergeau at redhat.com>
Date:   Wed Mar 30 17:38:13 2016 +0100

    char-device: Avoid use-after-free
    
    Reset pointer after freeing the structure pointing to it.
    
    Acked-by: Jonathon Jongsma <jjongsma at redhat.com>

diff --git a/server/char-device.c b/server/char-device.c
index 6704678..53bfe82 100644
--- a/server/char-device.c
+++ b/server/char-device.c
@@ -211,6 +211,7 @@ static void spice_char_device_client_free(SpiceCharDeviceState *dev,
 
     if (dev_client->wait_for_tokens_timer) {
         reds_core_timer_remove(dev->priv->reds, dev_client->wait_for_tokens_timer);
+        dev_client->wait_for_tokens_timer = NULL;
     }
 
     spice_char_device_client_send_queue_free(dev, dev_client);