From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51824) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X1tlC-0008Qb-Nf for qemu-devel@nongnu.org; Tue, 01 Jul 2014 04:49:59 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X1tl7-0006Kh-3x for qemu-devel@nongnu.org; Tue, 01 Jul 2014 04:49:54 -0400 Received: from mx1.redhat.com ([209.132.183.28]:1564) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X1tl6-0006KP-S4 for qemu-devel@nongnu.org; Tue, 01 Jul 2014 04:49:49 -0400 From: Stefan Hajnoczi Date: Tue, 1 Jul 2014 10:48:52 +0200 Message-Id: <1404204537-5082-20-git-send-email-stefanha@redhat.com> In-Reply-To: <1404204537-5082-1-git-send-email-stefanha@redhat.com> References: <1404204537-5082-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL for-2.1 19/24] block/cow: Avoid use of uninitialized cow_bs in error path List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefan Hajnoczi From: Peter Maydell Commit 25814e8987 introduced an error-exit code path which does a "goto exit" before the cow_bs variable is initialized, meaning we would call bdrv_unref() on an uninitialized variable and likely segfault. Fix this by moving the NULL-initialization to the top of the function and making the exit code path handle the case where it is NULL. Signed-off-by: Peter Maydell Reviewed-by: Eric Blake Signed-off-by: Stefan Hajnoczi --- block/cow.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/block/cow.c b/block/cow.c index 8f81ee6..6ee4833 100644 --- a/block/cow.c +++ b/block/cow.c @@ -332,7 +332,7 @@ static int cow_create(const char *filename, QemuOpts *opts, Error **errp) char *image_filename = NULL; Error *local_err = NULL; int ret; - BlockDriverState *cow_bs; + BlockDriverState *cow_bs = NULL; /* Read out options */ image_sectors = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / 512; @@ -344,7 +344,6 @@ static int cow_create(const char *filename, QemuOpts *opts, Error **errp) goto exit; } - cow_bs = NULL; ret = bdrv_open(&cow_bs, filename, NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL, NULL, &local_err); if (ret < 0) { @@ -383,7 +382,9 @@ static int cow_create(const char *filename, QemuOpts *opts, Error **errp) exit: g_free(image_filename); - bdrv_unref(cow_bs); + if (cow_bs) { + bdrv_unref(cow_bs); + } return ret; } -- 1.9.3