* [Qemu-devel] [PATCH] block/qcow2-snapshot: Fix a null pointer dereference in qcow2_free_snapshots
@ 2017-08-10 7:52 Hu Chaojian
2017-08-10 10:24 ` Kevin Wolf
0 siblings, 1 reply; 2+ messages in thread
From: Hu Chaojian @ 2017-08-10 7:52 UTC (permalink / raw)
To: qemu-devel@nongnu.org
Cc: qemu-trivial@nongnu.org, ppandit@redhat.com, jasowang@redhat.com,
kwolf@redhat.com, stefanha@redhat.com, Hu Chaojian
From: chaojianhu <chaojianhu@hotmail.com>
In function qcow2_do_open, if "go fail;" before calling qcow2_read_snapshots, then snapshots
will always be NULL. When dealing with "fail:", qcow2_free_snapshots will be called, and
s->snapshots will be dereferenced without checked.
Reported-by: chaojianhu <chaojianhu@hotmail.com>
Signed-off-by: chaojianhu <chaojianhu@hotmail.com>
---
block/qcow2-snapshot.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index 44243e0..4a8128c 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -35,6 +35,10 @@ void qcow2_free_snapshots(BlockDriverState *bs)
BDRVQcow2State *s = bs->opaque;
int i;
+ if (NULL == s->snapshots) {
+ return;
+ }
+
for(i = 0; i < s->nb_snapshots; i++) {
g_free(s->snapshots[i].name);
g_free(s->snapshots[i].id_str);
--
1.9.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [Qemu-devel] [PATCH] block/qcow2-snapshot: Fix a null pointer dereference in qcow2_free_snapshots
2017-08-10 7:52 [Qemu-devel] [PATCH] block/qcow2-snapshot: Fix a null pointer dereference in qcow2_free_snapshots Hu Chaojian
@ 2017-08-10 10:24 ` Kevin Wolf
0 siblings, 0 replies; 2+ messages in thread
From: Kevin Wolf @ 2017-08-10 10:24 UTC (permalink / raw)
To: Hu Chaojian
Cc: qemu-devel@nongnu.org, qemu-trivial@nongnu.org,
ppandit@redhat.com, jasowang@redhat.com, stefanha@redhat.com
Am 10.08.2017 um 09:52 hat Hu Chaojian geschrieben:
> From: chaojianhu <chaojianhu@hotmail.com>
>
> In function qcow2_do_open, if "go fail;" before calling qcow2_read_snapshots, then snapshots
> will always be NULL. When dealing with "fail:", qcow2_free_snapshots will be called, and
> s->snapshots will be dereferenced without checked.
Did you try to reproduce an actual crash?
Becasue I don't think there will be one. In this case, s->nb_snapshots
is 0, so the loop doesn't even run.
Kevin
> Reported-by: chaojianhu <chaojianhu@hotmail.com>
> Signed-off-by: chaojianhu <chaojianhu@hotmail.com>
>
> ---
> block/qcow2-snapshot.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
> index 44243e0..4a8128c 100644
> --- a/block/qcow2-snapshot.c
> +++ b/block/qcow2-snapshot.c
> @@ -35,6 +35,10 @@ void qcow2_free_snapshots(BlockDriverState *bs)
> BDRVQcow2State *s = bs->opaque;
> int i;
>
> + if (NULL == s->snapshots) {
> + return;
> + }
> +
> for(i = 0; i < s->nb_snapshots; i++) {
> g_free(s->snapshots[i].name);
> g_free(s->snapshots[i].id_str);
> --
> 1.9.1
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-08-10 10:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-08-10 7:52 [Qemu-devel] [PATCH] block/qcow2-snapshot: Fix a null pointer dereference in qcow2_free_snapshots Hu Chaojian
2017-08-10 10:24 ` Kevin Wolf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).