External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-31 17:05:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

conf: fix use after free in virChrdevOpen

Browse Source 
Don't free the stream on error if we've successfully added it
to the hash table, since it will be freed by virChrdevHashEntryFree
callback.

Preserve the error message before calling virStreamFree, since it
resets the error.

Introduced by 4716138, crashing since 6921892.

Reported by Sergey Fionov on libvir-list.
(cherry picked from commit a32b41746c4e1a44fb998a93da99c72f6586b359)
This commit is contained in:
Ján Tomko 2013-05-22 12:56:23 +02:00
parent aeef630b5d
commit 5313dd013f
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/conf/virchrdev.c
View File

@ -342,6 +342,8 @@ int virChrdevOpen(virChrdevsPtr devs,
virStreamPtr savedStream; virStreamPtr savedStream;
const char *path; const char *path;
int ret; int ret;
bool added = false;
virErrorPtr savedError;
switch (source->type) { switch (source->type) {
case VIR_DOMAIN_CHR_TYPE_PTY: case VIR_DOMAIN_CHR_TYPE_PTY:
@ -398,6 +400,7 @@ int virChrdevOpen(virChrdevsPtr devs,
if (virHashAddEntry(devs->hash, path, st) < 0) if (virHashAddEntry(devs->hash, path, st) < 0)
goto error; goto error;
added = true;
cbdata->devs = devs; cbdata->devs = devs;
if (!(cbdata->path = strdup(path))) { if (!(cbdata->path = strdup(path))) {
@ -432,8 +435,16 @@ int virChrdevOpen(virChrdevsPtr devs,
return 0; return 0;
error: error:
virStreamFree(st); savedError = virSaveLastError();
virHashRemoveEntry(devs->hash, path);
if (added)
virHashRemoveEntry(devs->hash, path);
else
virStreamFree(st);
virSetError(savedError);
virFreeError(savedError);
if (cbdata) if (cbdata)
VIR_FREE(cbdata->path); VIR_FREE(cbdata->path);
VIR_FREE(cbdata); VIR_FREE(cbdata);