diff options
| author | Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> | 2017-02-25 22:31:55 +0300 |
|---|---|---|
| committer | Dr. David Alan Gilbert <dgilbert@redhat.com> | 2017-02-28 11:30:23 +0000 |
| commit | f9c8caa04f7f2bed12dc5a4d7e92a59fe6677b37 (patch) | |
| tree | 1a783b2de80762744924e7e74e18a2bce393b30b /ioport.c | |
| parent | 5f9412bbac3a6906b2277d6b8aea02bc12a8464d (diff) | |
| download | qemu-f9c8caa04f7f2bed12dc5a4d7e92a59fe6677b37.zip | |
migration: fix use-after-free of to_dst_file
hmp_savevm calls qemu_savevm_state(f), which sets to_dst_file=f in
global migration state. Then hmp_savevm closes f (g_free called).
Next access to to_dst_file in migration state (for example,
qmp_migrate_set_speed) will use it after it was freed.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20170225193155.447462-5-vsementsov@virtuozzo.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Diffstat (limited to 'ioport.c')
0 files changed, 0 insertions, 0 deletions