OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

block: fix dangling bs->explicit_options in block.c

Browse Source 
In some error paths it is possible to QDECREF a freed dangling
explicit_options, resulting in a heap overflow crash.  For example
bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls
bdrv_close which also unrefs it.

Signed-off-by: Manos Pitsidianakis <el13635@mail.ntua.gr>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
Manos Pitsidianakis 2017-07-14 17:35:47 +03:00 committed by Kevin Wolf
parent b81b74bfb2
commit 998cbd6a44
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
block.c
View File

@ -2608,6 +2608,7 @@ fail:
QDECREF(bs->options);
QDECREF(options);
bs->options = NULL;
bs->explicit_options = NULL;
bdrv_unref(bs);
error_propagate(errp, local_err);
return NULL;
@ -3087,6 +3088,7 @@ static void bdrv_close(BlockDriverState *bs)
QDECREF(bs->options);
QDECREF(bs->explicit_options);
bs->options = NULL;
bs->explicit_options = NULL;
QDECREF(bs->full_open_options);
bs->full_open_options = NULL;
}