test_console: fix use-after-free
Here's how it goes: 1. stdin reaches EOF, kmscon_eloop_rm_fd is called on stdin_fd. 2. The fd object is freed, the memory is reused in the meantime. 3. rm_fd is called again in destroy_eloop. 4. con->stdin_fd points to garbage and we get a segmentation fault. Signed-off-by: Ran Benita <ran234@gmail.com> Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
This commit is contained in:
parent
993b7386d7
commit
01e469b9ec
@ -96,6 +96,7 @@ static void stdin_cb(struct kmscon_fd *fd, int mask, void *data)
|
||||
} else if (!ret) {
|
||||
log_info("stdin closed\n");
|
||||
kmscon_eloop_rm_fd(fd);
|
||||
con->stdin_fd = NULL;
|
||||
} else {
|
||||
len = ret;
|
||||
log_debug("stdin input read (len: %d)\n", len);
|
||||
|
Loading…
x
Reference in New Issue
Block a user