* [Qemu-devel] possible bug in block-vmdk.c
@ 2008-11-27 14:06 Rosen Sharma
2008-11-27 19:05 ` Ed Maste
0 siblings, 1 reply; 2+ messages in thread
From: Rosen Sharma @ 2008-11-27 14:06 UTC (permalink / raw)
To: qemu-devel
[-- Attachment #1: Type: text/plain, Size: 348 bytes --]
bdrv_delete(s->hd) frees the memory pointed to by s->hd.
vmdk_parent_close accesses the freed memory?
----
static void vmdk_close(BlockDriverState *bs)
{
BDRVVmdkState *s = bs->opaque;
qemu_free(s->l1_table);
qemu_free(s->l2_cache);
bdrv_delete(s->hd);
// try to close parent image, if exist
vmdk_parent_close(s->hd);
}
[-- Attachment #2: Type: text/html, Size: 514 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [Qemu-devel] possible bug in block-vmdk.c
2008-11-27 14:06 [Qemu-devel] possible bug in block-vmdk.c Rosen Sharma
@ 2008-11-27 19:05 ` Ed Maste
0 siblings, 0 replies; 2+ messages in thread
From: Ed Maste @ 2008-11-27 19:05 UTC (permalink / raw)
To: qemu-devel
On Thu, Nov 27, 2008 at 06:06:53AM -0800, Rosen Sharma wrote:
> bdrv_delete(s->hd) frees the memory pointed to by s->hd.
>
> vmdk_parent_close accesses the freed memory?
This was fixed by:
---
Revision: 4526
http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=4526
Author: ths
Date: 2008-05-22 13:51:48 +0000 (Thu, 22 May 2008)
Log Message:
-----------
Fix block-vmdk.c:vmdk_close() use-after-free, by Ed Maste.
---
-Ed
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2008-11-27 19:27 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-11-27 14:06 [Qemu-devel] possible bug in block-vmdk.c Rosen Sharma
2008-11-27 19:05 ` Ed Maste
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).