pxcloud/spice
5
0
Fork 0
mirror of https://gitlab.uni-freiburg.de/opensourcevdi/spice synced 2025-12-27 15:45:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

char-device: set to NULL freed pointers on destroy

Browse Source 
As SpiceCharDeviceState is only unref'ed on
spice_char_device_state_destroy the same device could be destroyed more
then once so the pointers that are freed should be set to NULL.

Related: https://bugzilla.redhat.com/show_bug.cgi?id=1281455
This commit is contained in:
Victor Toso 2015-11-13 10:44:55 +01:00
parent 57fe8ce268
commit c429574bb6
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
server/char_device.c
View File

@ -742,11 +742,13 @@ void spice_char_device_state_destroy(SpiceCharDeviceState *char_dev)
reds_on_char_device_state_destroy(char_dev);
if (char_dev->write_to_dev_timer) {
core->timer_remove(char_dev->write_to_dev_timer);
char_dev->write_to_dev_timer = NULL;
}
write_buffers_queue_free(&char_dev->write_queue);
write_buffers_queue_free(&char_dev->write_bufs_pool);
char_dev->cur_pool_size = 0;
spice_char_device_write_buffer_free(char_dev->cur_write_buf);
char_dev->cur_write_buf = NULL;
while (!ring_is_empty(&char_dev->clients)) {
RingItem *item = ring_get_tail(&char_dev->clients);