From: Marc-André Lureau <[email protected]>
When the new cursor is the same object as the one already held by
the console and the refcount is 1, cursor_unref frees it before
cursor_ref can increment the count.
Ref the incoming cursor before unreffing the old one so the
refcount goes 1-2-1 instead of 1-0 (freed) then use-after-free.
This is related to 385ac97f8fad ("ui: keep current cursor with
QemuConsole"), but could have happened earlier with VNC too.
Signed-off-by: Marc-André Lureau <[email protected]>
---
ui/console.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/ui/console.c b/ui/console.c
index a8a2a247d8f4..4db8f1cb431f 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -904,8 +904,9 @@ void qemu_console_set_cursor(QemuConsole *c, QEMUCursor
*cursor)
DisplayState *s = c->ds;
DisplayChangeListener *dcl;
+ cursor_ref(cursor);
cursor_unref(con->cursor);
- con->cursor = cursor_ref(cursor);
+ con->cursor = cursor;
QLIST_FOREACH(dcl, &s->listeners, next) {
if (c != dcl->con) {
continue;
--
2.55.0.543.g5ebe2ebe4ea8
