qemu_iovec_destroy does not clear the QEMUIOVector fully, and the data could thus be used after free or freed again. While I do not know any example in the tree, I observed this using virtio-scsi (and SCSI scatter/gather) when canceling DMA requests. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
…
…
…
…
…
…
…
…
…
…
…
Read the documentation in qemu-doc.html or on http://wiki.qemu.org - QEMU team
Description
Languages
C
90.3%
Dylan
2.5%
Python
2.1%
C++
2%
Shell
1.7%
Other
1.4%