[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PULL 7/7] chardev/wctable: don't free the instance in wctablet_chr_fina

From: Paolo Bonzini
Subject: [PULL 7/7] chardev/wctable: don't free the instance in wctablet_chr_finalize
Date: Fri, 19 Nov 2021 15:45:39 +0100

From: Daniil Tatianin <d-tatianin@yandex-team.ru>

Object is supposed to be freed by invoking obj->free, and not
obj->instance_finalize. This would lead to use-after-free followed by
double free in object_unref/object_finalize.

Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20211117142349.836279-1-d-tatianin@yandex-team.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 chardev/wctablet.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/chardev/wctablet.c b/chardev/wctablet.c
index 95e005f5a5..e8b292c43c 100644
--- a/chardev/wctablet.c
+++ b/chardev/wctablet.c
@@ -320,7 +320,6 @@ static void wctablet_chr_finalize(Object *obj)
     TabletChardev *tablet = WCTABLET_CHARDEV(obj);
-    g_free(tablet);
 static void wctablet_chr_open(Chardev *chr,

reply via email to

[Prev in Thread] Current Thread [Next in Thread]