[Spice-devel] [spice PATCH v1 1/2] char-device: set to NULL freed pointers on destroy

[Fabiano Fidêncio]

On Fri, Nov 13, 2015 at 11:11 AM, Victor Toso <victortoso at redhat.com> wrote:
> As SpiceCharDeviceState is only unref on spice_char_device_state_destroy

s/unref/unref'ed/

> the same device could be destroyed more then once so the pointers that
> are freed should be set to NULL.
>
> Related: https://bugzilla.redhat.com/show_bug.cgi?id=1281455
> ---
>  server/char_device.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/server/char_device.c b/server/char_device.c
> index fe38385..ae7cb98 100644
> --- a/server/char_device.c
> +++ b/server/char_device.c
> @@ -742,11 +742,13 @@ void spice_char_device_state_destroy(SpiceCharDeviceState *char_dev)
>      reds_on_char_device_state_destroy(char_dev);
>      if (char_dev->write_to_dev_timer) {
>          core->timer_remove(char_dev->write_to_dev_timer);
> +        char_dev->write_to_dev_timer = NULL;
>      }
>      write_buffers_queue_free(&char_dev->write_queue);
>      write_buffers_queue_free(&char_dev->write_bufs_pool);
>      char_dev->cur_pool_size = 0;
>      spice_char_device_write_buffer_free(char_dev->cur_write_buf);
> +    char_dev->cur_write_buf = NULL;
>
>      while (!ring_is_empty(&char_dev->clients)) {
>          RingItem *item = ring_get_tail(&char_dev->clients);
> --
> 2.5.0
>
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/spice-devel

ACK with the changes in the commit log!