commit 02a8ee2e1840d13db065f418969bcfcb404a94cb
author Marc-André Lureau <marcandre.lureau@redhat.com> Mon Feb 14 15:59:17 2022 +0400
committer Gerd Hoffmann <kraxel@redhat.com> Fri Mar 04 11:29:34 2022 +0100
tree 564c955d6ea6fa136943b20fc5153b225440aa80
parent cb8962c146b2633a4b04562281de9b2703bba849

ui/clipboard: fix use-after-free regression

The same info may be used to update the clipboard, and may be freed
before being ref'ed again.

Fixes: 70a54b01693ed ("ui: avoid compiler warnings from unused clipboard info variable")

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20220214115917.1679568-1-marcandre.lureau@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

ui/clipboard.c

diff --git a/ui/clipboard.c b/ui/clipboard.c
index 5f15cf8..9079ef8 100644
--- a/ui/clipboard.c
+++ b/ui/clipboard.c
@@ -66,8 +66,10 @@
 
     notifier_list_notify(&clipboard_notifiers, &notify);
 
-    qemu_clipboard_info_unref(cbinfo[info->selection]);
-    cbinfo[info->selection] = qemu_clipboard_info_ref(info);
+    if (cbinfo[info->selection] != info) {
+        qemu_clipboard_info_unref(cbinfo[info->selection]);
+        cbinfo[info->selection] = qemu_clipboard_info_ref(info);
+    }
 }
 
 QemuClipboardInfo *qemu_clipboard_info(QemuClipboardSelection selection)