From cc9f60d4a2a4bf2578a9309a18f1c4602c9f5ce7 Mon Sep 17 00:00:00 2001 From: Eric Blake Date: Thu, 5 Nov 2015 23:35:27 -0700 Subject: qobject: Protect against use-after-free in qobject_decref() Adding an assertion to qobject_decref() will ensure that a programming error causing use-after-free will result in immediate failure (provided no other thread has started using the memory) instead of silently attempting to wrap refcnt around and leaving the problem to potentially bite later at a harder point to diagnose. Suggested-by: Markus Armbruster Signed-off-by: Eric Blake Message-Id: <1446791754-23823-4-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster --- include/qapi/qmp/qobject.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/qapi/qmp/qobject.h b/include/qapi/qmp/qobject.h index c856f553b7..4b96ed5837 100644 --- a/include/qapi/qmp/qobject.h +++ b/include/qapi/qmp/qobject.h @@ -90,6 +90,7 @@ static inline void qobject_incref(QObject *obj) */ static inline void qobject_decref(QObject *obj) { + assert(!obj || obj->refcnt); if (obj && --obj->refcnt == 0) { assert(obj->type != NULL); assert(obj->type->destroy != NULL); -- cgit v1.2.3