On 01/23/2013 10:25 AM, Daniel P. Berrange wrote:
> From: "Daniel P. Berrange" <berrange@xxxxxxxxxx>
>
> The autodestroy callback code has the following function
> called from a hash iterator
>
> qemuDriverCloseCallbackRun(void *payload,
> const void *name,
> void *opaque)
> {
> ...
> char *uuidstr = name
> ...
>
> dom = closeDef->cb(data->driver, dom, data->conn);
> if (dom)
> virObjectUnlock(dom);
>
> virHashRemoveEntry(data->driver->closeCallbacks, uuidstr);
> }
>
> The closeDef->cb function may well cause the current callback
> to be removed, if it shuts down 'dom'. As such the use of
> 'uuidstr' in virHashRemoveEntry is accessing free'd memory.
> We must make a copy of the uuid str before invoking the
> callback to be safe.
>
> Signed-off-by: Daniel P. Berrange <berrange@xxxxxxxxxx>
> ---
> src/qemu/qemu_conf.c | 13 +++++++++----
> 1 file changed, 9 insertions(+), 4 deletions(-)
ACK.
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
Attachment:
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list