From 80fb34eda099e7cc519a91e9701ab3c0262717b3 Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" Date: Wed, 25 Jan 2017 11:10:53 +0000 Subject: io: fix possible double free of task error object If a QIOTask has an error set and the calling code uses qio_task_propagate_error() to steal the reference to that Error object, the task would not clear its own reference. This would lead to a double-free when qio_task_free runs, if the caller had (correctly) freed the Error object they now owned. Signed-off-by: Daniel P. Berrange --- io/task.c | 1 + 1 file changed, 1 insertion(+) (limited to 'io/task.c') diff --git a/io/task.c b/io/task.c index 60bf1a94d5..3ce556017c 100644 --- a/io/task.c +++ b/io/task.c @@ -157,6 +157,7 @@ bool qio_task_propagate_error(QIOTask *task, { if (task->err) { error_propagate(errp, task->err); + task->err = NULL; return true; } -- cgit v1.2.3