From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36061) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XFzJM-00076Y-EO for qemu-devel@nongnu.org; Sat, 09 Aug 2014 01:35:29 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XFzJE-0001Fs-9P for qemu-devel@nongnu.org; Sat, 09 Aug 2014 01:35:24 -0400 Received: from [58.251.49.30] (port=58641 helo=mail.sangfor.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XFzJC-0001FB-VX for qemu-devel@nongnu.org; Sat, 09 Aug 2014 01:35:16 -0400 Received: from localhost (mail.sangfor.com [127.0.0.1]) by mail.sangfor.com (Postfix) with ESMTP id 6B55017C008F for ; Sat, 9 Aug 2014 13:23:59 +0800 (CST) Received: from mail.sangfor.com ([127.0.0.1]) by localhost (mail.sangfor.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JDBhSLC1DQOg for ; Sat, 9 Aug 2014 13:23:58 +0800 (CST) Received: from vv-PC (unknown [10.10.6.254]) by mail.sangfor.com (Postfix) with ESMTPA id CCEBA17C008B for ; Sat, 9 Aug 2014 13:23:58 +0800 (CST) Date: Sat, 9 Aug 2014 13:33:20 +0800 From: "Zhang Haoyu" Message-ID: <201408091333190205168@sangfor.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [patch] qcow2: double free snapshots List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel In qcow2_open(), if qcow2_read_snapshots() failed, qcow2_open() -> qcow2_free_snapshots() will be called, NULL snapshots dereference happened. because qcow2_free_snapshots has been performed before in the fail case of qcow2_read_snapshots(). shown as below callstack, qcow2_open |- qcow2_read_snapshots |-- goto fail; |-- qcow2_free_snapshots |- goto fail; |- qcow2_free_snapshots /* on this case, NULL snapshots dereference happened. */ Signed-off-by: Zhang Haoyu --- block/qcow2-snapshot.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c index 0aa9def..15c0513 100644 --- a/block/qcow2-snapshot.c +++ b/block/qcow2-snapshot.c @@ -31,6 +31,10 @@ void qcow2_free_snapshots(BlockDriverState *bs) BDRVQcowState *s = bs->opaque; int i; + if (!s || !s->snapshots) { + return; + } + for(i = 0; i < s->nb_snapshots; i++) { g_free(s->snapshots[i].name); g_free(s->snapshots[i].id_str); -- 1.9.4.msysgit.0