diff options
| author | Avi Kivity <avi@redhat.com> | 2011-11-13 12:00:55 +0200 |
|---|---|---|
| committer | Avi Kivity <avi@redhat.com> | 2011-11-13 12:00:55 +0200 |
| commit | 88365e47dd19da8776252a94ed5fa0b7242ea9e9 (patch) | |
| tree | ba54bc24ed2481440c8b569ff18d275bbf568dd4 /memory.c | |
| parent | 74d33d5ce4d70125fa7ff476145276a44372e9d5 (diff) | |
| download | focaccia-qemu-88365e47dd19da8776252a94ed5fa0b7242ea9e9.tar.gz focaccia-qemu-88365e47dd19da8776252a94ed5fa0b7242ea9e9.zip | |
memory: fix 'info mtree' segfaults
'info mtree' accesses invalid memory in two cases, both due to incorrect (and unsafe) usage of QTAILQ_FOREACH_SAFE(). Reported-by: Andreas Färber <afaerber@suse.de> Signed-off-by: Avi Kivity <avi@redhat.com>
Diffstat (limited to 'memory.c')
| -rw-r--r-- | memory.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/memory.c b/memory.c index c0c1d12d79..7c20a0703f 100644 --- a/memory.c +++ b/memory.c @@ -1401,7 +1401,7 @@ static void mtree_print_mr(fprintf_function mon_printf, void *f, alias_print_queue); } - QTAILQ_FOREACH_SAFE(next_ml, &submr_print_queue, queue, ml) { + QTAILQ_FOREACH_SAFE(ml, &submr_print_queue, queue, next_ml) { g_free(ml); } } @@ -1425,7 +1425,7 @@ void mtree_info(fprintf_function mon_printf, void *f) } QTAILQ_FOREACH_SAFE(ml, &ml_head, queue, ml2) { - g_free(ml2); + g_free(ml); } if (address_space_io.root && |