From 88365e47dd19da8776252a94ed5fa0b7242ea9e9 Mon Sep 17 00:00:00 2001 From: Avi Kivity Date: Sun, 13 Nov 2011 12:00:55 +0200 Subject: [PATCH] memory: fix 'info mtree' segfaults MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit 'info mtree' accesses invalid memory in two cases, both due to incorrect (and unsafe) usage of QTAILQ_FOREACH_SAFE(). Reported-by: Andreas Färber Signed-off-by: Avi Kivity --- memory.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/memory.c b/memory.c index c0c1d12..7c20a07 100644 --- a/memory.c +++ b/memory.c @@ -1401,7 +1401,7 @@ static void mtree_print_mr(fprintf_function mon_printf, void *f, alias_print_queue); } - QTAILQ_FOREACH_SAFE(next_ml, &submr_print_queue, queue, ml) { + QTAILQ_FOREACH_SAFE(ml, &submr_print_queue, queue, next_ml) { g_free(ml); } } @@ -1425,7 +1425,7 @@ void mtree_info(fprintf_function mon_printf, void *f) } QTAILQ_FOREACH_SAFE(ml, &ml_head, queue, ml2) { - g_free(ml2); + g_free(ml); } if (address_space_io.root && -- 2.7.4