test_console: fix use-after-free

Here's how it goes:
1. stdin reaches EOF, kmscon_eloop_rm_fd is called on stdin_fd.
2. The fd object is freed, the memory is reused in the meantime.
3. rm_fd is called again in destroy_eloop.
4. con->stdin_fd points to garbage and we get a segmentation fault.

Signed-off-by: Ran Benita <ran234@gmail.com>
Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
This commit is contained in:
Ran Benita 2011-12-31 12:31:53 +02:00 committed by David Herrmann
parent 993b7386d7
commit 01e469b9ec

View File

@ -96,6 +96,7 @@ static void stdin_cb(struct kmscon_fd *fd, int mask, void *data)
} else if (!ret) {
log_info("stdin closed\n");
kmscon_eloop_rm_fd(fd);
con->stdin_fd = NULL;
} else {
len = ret;
log_debug("stdin input read (len: %d)\n", len);