External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-23 06:05:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

snapshot: fix snapshot deletion use-after-free

Browse Source 
Bug introduced in commit 35abced.  On an inactive domain,
$ virsh snapshot-create-as dom snap
$ virsh snapshot-create dom
$ virsh snapshot-create dom
$ virsh snapshot-delete --children dom snap
could crash libvirtd, due to a use-after-free that results
when the callback freed the current element in the iteration.

* src/conf/domain_conf.c (virDomainSnapshotForEachChild)
(virDomainSnapshotActOnDescendant): Allow iteration to delete
current child.
This commit is contained in:
Eric Blake 2012-02-14 13:08:56 -07:00
parent 15a280bb6d
commit 4c1c361127
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/conf/domain_conf.c
View File

@ -13347,8 +13347,9 @@ virDomainSnapshotForEachChild(virDomainSnapshotObjPtr snapshot,
virDomainSnapshotObjPtr child = snapshot->first_child; virDomainSnapshotObjPtr child = snapshot->first_child;
while (child) { while (child) {
virDomainSnapshotObjPtr next = child->sibling;
(iter)(child, child->def->name, data); (iter)(child, child->def->name, data);
child = child->sibling; child = next;
} }
return snapshot->nchildren; return snapshot->nchildren;
@ -13368,10 +13369,10 @@ virDomainSnapshotActOnDescendant(void *payload,
virDomainSnapshotObjPtr obj = payload; virDomainSnapshotObjPtr obj = payload;
struct snapshot_act_on_descendant *curr = data; struct snapshot_act_on_descendant *curr = data;
(curr->iter)(payload, name, curr->data);
curr->number += 1 + virDomainSnapshotForEachDescendant(obj, curr->number += 1 + virDomainSnapshotForEachDescendant(obj,
curr->iter, curr->iter,
curr->data); curr->data);
(curr->iter)(payload, name, curr->data);
} }
/* Run iter(data) on all descendants of snapshot, while ignoring all /* Run iter(data) on all descendants of snapshot, while ignoring all