Commit 0e79668e authored by zhanghailiang's avatar zhanghailiang Committed by Jason Wang
Browse files

net/colo: fix memory double free error 



The 'primary_list' and 'secondary_list' members of struct Connection
is not allocated through dynamically g_queue_new(), but we free it by using
g_queue_free(), which will lead to a double-free bug.

Reviewed-by: default avatarZhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: default avatarzhanghailiang <zhang.zhanghailiang@huawei.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
parent a11f5cb0

net/colo.c

+2 −2
Original line number Diff line number Diff line
@@ -147,9 +147,9 @@ void connection_destroy(void *opaque) 
    Connection *conn = opaque;



    g_queue_foreach(&conn->primary_list, packet_destroy, NULL);

    g_queue_free(&conn->primary_list);

    g_queue_clear(&conn->primary_list);

    g_queue_foreach(&conn->secondary_list, packet_destroy, NULL);

    g_queue_free(&conn->secondary_list);

    g_queue_clear(&conn->secondary_list);

    g_slice_free(Connection, conn);

}