qemu-e2k/migration
Peter Maydell f151f8aca5 migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()
Coverity points out (CID 1400442) that in this code:

    if (packet->pages_alloc > p->pages->allocated) {
        multifd_pages_clear(p->pages);
        multifd_pages_init(packet->pages_alloc);
    }

we free p->pages in multifd_pages_clear() but continue to
use it in the following code. We also leak memory, because
multifd_pages_init() returns the pointer to a new MultiFDPages_t
struct but we are ignoring its return value.

Fix both of these bugs by adding the missing assignment of
the newly created struct to p->pages.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Message-id: 20190409151830.6024-1-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-04-09 20:46:34 +01:00
..
block-dirty-bitmap.c
block.c
block.h
channel.c
channel.h
colo-failover.c
colo.c
exec.c
exec.h
fd.c
fd.h
global_state.c
Makefile.objs
migration.c
migration.h
page_cache.c
page_cache.h
postcopy-ram.c
postcopy-ram.h
qemu-file-channel.c
qemu-file-channel.h
qemu-file.c
qemu-file.h
qjson.c
qjson.h
ram.c
ram.h
rdma.c
rdma.h
savevm.c
savevm.h
socket.c
socket.h
tls.c
tls.h
trace-events
vmstate-types.c
vmstate.c
xbzrle.c
xbzrle.h