diff options
| author | Manos Pitsidianakis | 2017-07-14 16:35:47 +0200 |
|---|---|---|
| committer | Kevin Wolf | 2017-08-01 18:09:33 +0200 |
| commit | 998cbd6a44cd96044f56713274bdf6a94cd721c0 (patch) | |
| tree | 99a0ad9848071b96050e36914d96ac6570ab4958 /block.c | |
| parent | iotests: Add test of recent fix to 'qemu-img measure' (diff) | |
| download | qemu-998cbd6a44cd96044f56713274bdf6a94cd721c0.tar.gz qemu-998cbd6a44cd96044f56713274bdf6a94cd721c0.tar.xz qemu-998cbd6a44cd96044f56713274bdf6a94cd721c0.zip | |
block: fix dangling bs->explicit_options in block.c
In some error paths it is possible to QDECREF a freed dangling
explicit_options, resulting in a heap overflow crash. For example
bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls
bdrv_close which also unrefs it.
Signed-off-by: Manos Pitsidianakis <el13635@mail.ntua.gr>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block.c')
| -rw-r--r-- | block.c | 2 |
1 files changed, 2 insertions, 0 deletions
@@ -2608,6 +2608,7 @@ fail: QDECREF(bs->options); QDECREF(options); bs->options = NULL; + bs->explicit_options = NULL; bdrv_unref(bs); error_propagate(errp, local_err); return NULL; @@ -3087,6 +3088,7 @@ static void bdrv_close(BlockDriverState *bs) QDECREF(bs->options); QDECREF(bs->explicit_options); bs->options = NULL; + bs->explicit_options = NULL; QDECREF(bs->full_open_options); bs->full_open_options = NULL; } |