From f151f8aca5cf5da24f6eb743a55a2233091ae532 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Tue, 9 Apr 2019 16:18:30 +0100 Subject: [PATCH] migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Coverity points out (CID 1400442) that in this code: if (packet->pages_alloc > p->pages->allocated) { multifd_pages_clear(p->pages); multifd_pages_init(packet->pages_alloc); } we free p->pages in multifd_pages_clear() but continue to use it in the following code. We also leak memory, because multifd_pages_init() returns the pointer to a new MultiFDPages_t struct but we are ignoring its return value. Fix both of these bugs by adding the missing assignment of the newly created struct to p->pages. Signed-off-by: Peter Maydell Reviewed-by: Juan Quintela Message-id: 20190409151830.6024-1-peter.maydell@linaro.org Reviewed-by: Philippe Mathieu-Daudé --- migration/ram.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/migration/ram.c b/migration/ram.c index f68beeeeff..1ca9ba77b6 100644 --- a/migration/ram.c +++ b/migration/ram.c @@ -851,7 +851,7 @@ static int multifd_recv_unfill_packet(MultiFDRecvParams *p, Error **errp) */ if (packet->pages_alloc > p->pages->allocated) { multifd_pages_clear(p->pages); - multifd_pages_init(packet->pages_alloc); + p->pages = multifd_pages_init(packet->pages_alloc); } p->pages->used = be32_to_cpu(packet->pages_used);