diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2024-03-11 09:16:12 +0100 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2024-03-20 09:47:16 +0100 |
| commit | 732810235f8e7c0f7c961201d9d05b1f5c1ab5a5 (patch) | |
| tree | bee9ee204b9812c7ff59e9c57ba8110c1c71376f /contrib | |
| parent | 7fd226b04746f0be0b636de5097f1b42338951a0 (diff) | |
tests/plugins: fix use-after-free bug
rec->count.score is inside rec, which is freed before rec->count.score is.
Reorder the instructions
Reported by Coverity as CID 1539967.
Cc: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'contrib')
| -rw-r--r-- | contrib/plugins/howvec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/contrib/plugins/howvec.c b/contrib/plugins/howvec.c index 2d10c87e0f..94bbc53820 100644 --- a/contrib/plugins/howvec.c +++ b/contrib/plugins/howvec.c @@ -167,9 +167,9 @@ static gint cmp_exec_count(gconstpointer a, gconstpointer b) static void free_record(gpointer data) { InsnExecCount *rec = (InsnExecCount *) data; + qemu_plugin_scoreboard_free(rec->count.score); g_free(rec->insn); g_free(rec); - qemu_plugin_scoreboard_free(rec->count.score); } static void plugin_exit(qemu_plugin_id_t id, void *p) |