monitor: fix use after free
The function monitor_fdset_dup_fd_find_remove() references member of 'mon_fdset' which - when remove flag is set - may be freed in function monitor_fdset_cleanup(). remove is set by monitor_fdset_dup_fd_remove which in practice does not need the returned value, so make it void, and return -1 from monitor_fdset_dup_fd_find_remove. Reported-by:zhanghailiang <zhang.zhanghailiang@huawei.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Luiz Capitulino <lcapitulino@redhat.com>
Loading
Please register or sign in to comment