From 4c1c361127b6f5ce56be980ca7ea06f829c53399 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Tue, 14 Feb 2012 13:08:56 -0700
Subject: [PATCH] snapshot: fix snapshot deletion use-after-free

Bug introduced in commit 35abced.  On an inactive domain,
$ virsh snapshot-create-as dom snap
$ virsh snapshot-create dom
$ virsh snapshot-create dom
$ virsh snapshot-delete --children dom snap
could crash libvirtd, due to a use-after-free that results
when the callback freed the current element in the iteration.

* src/conf/domain_conf.c (virDomainSnapshotForEachChild)
(virDomainSnapshotActOnDescendant): Allow iteration to delete
current child.
---
 src/conf/domain_conf.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 9b03b56d0e..85a2058005 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -13347,8 +13347,9 @@ virDomainSnapshotForEachChild(virDomainSnapshotObjPtr snapshot,
     virDomainSnapshotObjPtr child = snapshot->first_child;
 
     while (child) {
+        virDomainSnapshotObjPtr next = child->sibling;
         (iter)(child, child->def->name, data);
-        child = child->sibling;
+        child = next;
     }
 
     return snapshot->nchildren;
@@ -13368,10 +13369,10 @@ virDomainSnapshotActOnDescendant(void *payload,
     virDomainSnapshotObjPtr obj = payload;
     struct snapshot_act_on_descendant *curr = data;
 
-    (curr->iter)(payload, name, curr->data);
     curr->number += 1 + virDomainSnapshotForEachDescendant(obj,
                                                            curr->iter,
                                                            curr->data);
+    (curr->iter)(payload, name, curr->data);
 }
 
 /* Run iter(data) on all descendants of snapshot, while ignoring all