提交 80fb34ed 编写于 作者: D Daniel P. Berrange

io: fix possible double free of task error object

If a QIOTask has an error set and the calling code uses
qio_task_propagate_error() to steal the reference to
that Error object, the task would not clear its own
reference. This would lead to a double-free when
qio_task_free runs, if the caller had (correctly) freed
the Error object they now owned.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
上级 c7f1cf01
......@@ -157,6 +157,7 @@ bool qio_task_propagate_error(QIOTask *task,
{
if (task->err) {
error_propagate(errp, task->err);
task->err = NULL;
return true;
}
......
......@@ -127,7 +127,7 @@ static void test_task_failure(void)
g_assert(data.source == obj);
g_assert(data.err == err);
g_assert(data.freed == false);
error_free(data.err);
}
......@@ -238,6 +238,8 @@ static void test_task_thread_failure(void)
g_assert(data.source == obj);
g_assert(data.err != NULL);
error_free(data.err);
self = g_thread_self();
/* Make sure the test_task_thread_worker actually got
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册