External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-22 12:35:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Avoid use of free'd memory in auto destroy callback

Browse Source 
The autodestroy callback code has the following function
called from a hash iterator

  qemuDriverCloseCallbackRun(void *payload,
                             const void *name,
                             void *opaque)
  {
    ...
    char *uuidstr = name
    ...

    dom = closeDef->cb(data->driver, dom, data->conn);
    if (dom)
        virObjectUnlock(dom);

    virHashRemoveEntry(data->driver->closeCallbacks, uuidstr);
  }

The closeDef->cb function may well cause the current callback
to be removed, if it shuts down 'dom'. As such the use of
'uuidstr' in virHashRemoveEntry is accessing free'd memory.
We must make a copy of the uuid str before invoking the
callback to be safe.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2013-01-23 17:22:27 +00:00
parent 83b4137d41
commit 4e4c6620e2
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/qemu/qemu_conf.c
View File

@ -510,20 +510,25 @@ qemuDriverCloseCallbackRun(void *payload,
{ {
struct qemuDriverCloseCallbackData *data = opaque; struct qemuDriverCloseCallbackData *data = opaque;
qemuDriverCloseDefPtr closeDef = payload; qemuDriverCloseDefPtr closeDef = payload;
const char *uuidstr = name;
unsigned char uuid[VIR_UUID_BUFLEN]; unsigned char uuid[VIR_UUID_BUFLEN];
char uuidstr[VIR_UUID_STRING_BUFLEN];
virDomainObjPtr dom; virDomainObjPtr dom;
VIR_DEBUG("conn=%p, thisconn=%p, uuid=%s, cb=%p", VIR_DEBUG("conn=%p, thisconn=%p, uuid=%s, cb=%p",
closeDef->conn, data->conn, uuidstr, closeDef->cb); closeDef->conn, data->conn, (const char *)name, closeDef->cb);
if (data->conn != closeDef->conn || !closeDef->cb) if (data->conn != closeDef->conn || !closeDef->cb)
return; return;
if (virUUIDParse(uuidstr, uuid) < 0) { if (virUUIDParse(name, uuid) < 0) {
VIR_WARN("Failed to parse %s", uuidstr); VIR_WARN("Failed to parse %s", (const char *)name);
return; return;
} }
/* We need to reformat uuidstr, because closeDef->cb
* might cause the current hash entry to be removed,
* which means 'name' will have been free()d
*/
virUUIDFormat(uuid, uuidstr);
if (!(dom = virDomainFindByUUID(&data->driver->domains, uuid))) { if (!(dom = virDomainFindByUUID(&data->driver->domains, uuid))) {
VIR_DEBUG("No domain object with UUID %s", uuidstr); VIR_DEBUG("No domain object with UUID %s", uuidstr);