[Spice-devel] [PATCH spice-gtk] Fix use after free of uri

Marc-André Lureau marcandre.lureau at gmail.com
Tue Nov 17 09:55:11 PST 2015


"path" points to "uri" memory, move free(uri) later.

Found thanks to valgrind :)

Signed-off-by: Marc-André Lureau <marcandre.lureau at gmail.com>
---
 src/spice-session.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/spice-session.c b/src/spice-session.c
index c673fa2..a36dcea 100644
--- a/src/spice-session.c
+++ b/src/spice-session.c
@@ -557,7 +557,6 @@ static int spice_parse_uri(SpiceSession *session, const char *original_uri)
 
 end:
     /* parsed ok -> apply */
-    g_free(uri);
     g_free(unescaped_path);
     g_free(s->unix_path);
     g_free(s->host);
@@ -566,6 +565,7 @@ end:
     g_free(s->username);
     g_free(s->password);
     s->unix_path = g_strdup(path);
+    g_free(uri);
     s->host = host;
     s->port = port;
     s->tls_port = tls_port;
-- 
2.5.0



More information about the Spice-devel mailing list