After spice_char_device_state_destroy is called spicevmc should avoid keeping reference to that memory. state->chardev_st and sin->st point to the same SpiceCharDeviceState and both should be set to NULL when it is destoryed. --- server/spicevmc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/server/spicevmc.c b/server/spicevmc.c index 6ac1561..d37b1ec 100644 --- a/server/spicevmc.c +++ b/server/spicevmc.c @@ -559,6 +559,7 @@ void spicevmc_device_disconnect(SpiceCharDeviceInstance *sin) } spice_char_device_state_destroy(sin->st); state->chardev_st = NULL; + sin->st = NULL; reds_unregister_channel(&state->channel); free(state->pipe_item); -- 2.5.0 _______________________________________________ Spice-devel mailing list Spice-devel@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/spice-devel