]> git.ipfire.org Git - thirdparty/qemu.git/commit
slirp: avoid use-after-free in slirp_pollfds_poll() if soread() returns an error
authorSteven Luo <steven+qemu@steven676.net>
Thu, 7 Apr 2016 05:04:32 +0000 (22:04 -0700)
committerSamuel Thibault <samuel.thibault@ens-lyon.org>
Thu, 7 Apr 2016 08:27:42 +0000 (10:27 +0200)
commitbfb1ac14029ee72b19296109fba880c0551755d5
tree270d62cb3221dc7f5353f8e7d5198ec1d98fb295
parentb5ab677189b93efa4eaa921f42b21dc008247184
slirp: avoid use-after-free in slirp_pollfds_poll() if soread() returns an error

Samuel Thibault pointed out that it's possible that slirp_pollfds_poll()
will try to use a socket even after soread() returns an error, resulting
in an use-after-free if the socket was removed while handling the error.
Avoid this by refusing to continue to work with the socket in this case.

Signed-off-by: Steven Luo <steven+qemu@steven676.net>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
slirp/slirp.c
slirp/socket.c
slirp/socket.h