slirp updates

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEaw+sIYVmRulKotIAoAMZaCdBSIAFAlgqHEQACgkQoAMZaCdB
 SICTbA//U78YOywlTGtbCGgPzNODkx7yMmp2h6jx1jHIyaE8nTsGioQFzI4du+tG
 dHDInA+XgKlHCxzb4M7tuRTxZsJUdWUnIdGnUQl137XoY9/DYiAju5hnlEHxv/0y
 0atG9wH5CxPiJ9R/gB1zw7MwFzwlIaHzndasZC2AeAYx22EhPzgoe2uuSc8HvSWH
 IRH78uzD1D2cLLMtRnJXqbdUP1+HK1QGTc0bSl/S13l5ify7N0YGSZt986EZvgY9
 DH0SpFRjD0Rue+UGeW9/nTp7ev3Is0xmSEI8OAwxUTl7NaztYnJlBjzuxlKnDWri
 Q20ZylpOMYhvhsGxO9U5gILonDhLInAe9GrHsuMRWnsmGW1MIkFhAxDC/Rq3rD0w
 5GmyTK5wSEsMmhdazALA9zVSqTNFPJqN7h2zjwoEysK3XE6tyPX0AY4DIjMiU+zb
 Mtr/+6vNAFxA0JMWDYv9A8K6WX9FWUtiswFhc4WMDC44KZgWwjXcNowqMC0s6B0h
 3FuXWbYWUvBBd+ENs6osXg0iFqM8G2ZCfPz2iEsdUIrCSCExpoJWliFU31k82NYi
 7nGNERKTJIZWHkv/DzMLmpK/hfuLmCMEWuVWfUgVoBPPC+jGlHJQHsUP5jIE2lo2
 23FgWuw3VgC7DvELvRqNJFfvkwOVUTWLfcDqeT4k2LZ3rBS9hpY=
 =NZG6
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'sthibault/tags/samuel-thibault' into staging

slirp updates

# gpg: Signature made Mon 14 Nov 2016 08:19:16 PM GMT
# gpg:                using RSA key 0xA003196827414880
# gpg: Good signature from "Samuel Thibault <samuel.thibault@u-bordeaux.fr>"
# gpg:                 aka "Samuel Thibault <sthibault@debian.org>"
# gpg:                 aka "Samuel Thibault <samuel.thibault@gnu.org>"
# gpg:                 aka "Samuel Thibault <samuel.thibault@inria.fr>"
# gpg:                 aka "Samuel Thibault <samuel.thibault@labri.fr>"
# gpg:                 aka "Samuel Thibault <samuel.thibault@ens-lyon.org>"
# Primary key fingerprint: 900C B024 B679 31D4 0F82  304B D017 8C76 7D06 9EE6
#      Subkey fingerprint: 6B0F AC21 8566 46E9 4AA2  D200 A003 1968 2741 4880

* sthibault/tags/samuel-thibault:
  slirp: Fix access to freed memory

Message-id: 20161114202030.17685-1-samuel.thibault@ens-lyon.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
master
Stefan Hajnoczi 2016-11-15 11:50:04 +00:00
commit 5d0df6de75
1 changed files with 17 additions and 0 deletions

View File

@ -66,6 +66,23 @@ void
sofree(struct socket *so)
{
Slirp *slirp = so->slirp;
struct mbuf *ifm;
for (ifm = (struct mbuf *) slirp->if_fastq.qh_link;
(struct quehead *) ifm != &slirp->if_fastq;
ifm = ifm->ifq_next) {
if (ifm->ifq_so == so) {
ifm->ifq_so = NULL;
}
}
for (ifm = (struct mbuf *) slirp->if_batchq.qh_link;
(struct quehead *) ifm != &slirp->if_batchq;
ifm = ifm->ifq_next) {
if (ifm->ifq_so == so) {
ifm->ifq_so = NULL;
}
}
if (so->so_emu==EMU_RSH && so->extra) {
sofree(so->extra);