]> git.ipfire.org Git - thirdparty/libvirt.git/commit
projects / thirdparty / libvirt.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 15a280b) | patch
snapshot: fix snapshot deletion use-after-free
authorEric Blake <eblake@redhat.com>
Tue, 14 Feb 2012 20:08:56 +0000 (13:08 -0700)
committerEric Blake <eblake@redhat.com>
Thu, 16 Feb 2012 00:24:05 +0000 (17:24 -0700)
commit4c1c361127b6f5ce56be980ca7ea06f829c53399
tree16d968f179c5bd73b14c07baffc91e4ade50e599tree
parent15a280bb6d2de16b2f54dd7ca667a5a69363558ccommit | diff
snapshot: fix snapshot deletion use-after-free

Bug introduced in commit 35abced.  On an inactive domain,
$ virsh snapshot-create-as dom snap
$ virsh snapshot-create dom
$ virsh snapshot-create dom
$ virsh snapshot-delete --children dom snap
could crash libvirtd, due to a use-after-free that results
when the callback freed the current element in the iteration.

* src/conf/domain_conf.c (virDomainSnapshotForEachChild)
(virDomainSnapshotActOnDescendant): Allow iteration to delete
current child.
src/conf/domain_conf.c diff | blob | blame | history
Mirror of https://github.com/libvirt/libvirt.git