[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 4/7] 9p: xattr: Fix crashes due to free of uninitiali
From: |
Greg Kurz |
Subject: |
[Qemu-devel] [PULL 4/7] 9p: xattr: Fix crashes due to free of uninitialized value |
Date: |
Thu, 7 Jun 2018 17:21:16 +0200 |
From: Keno Fischer <address@hidden>
If the size returned from llistxattr/lgetxattr is 0, we skipped
the malloc call, leaving xattr.value uninitialized. However, this
value is later passed to `g_free` without any further checks,
causing an error. Fix that by always calling g_malloc unconditionally.
If `size` is 0, it will return NULL, which is safe to pass to g_free.
Signed-off-by: Keno Fischer <address@hidden>
Signed-off-by: Greg Kurz <address@hidden>
---
hw/9pfs/9p.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index d74302deeba5..4386d698177b 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -3256,8 +3256,8 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque)
xattr_fidp->fs.xattr.len = size;
xattr_fidp->fid_type = P9_FID_XATTR;
xattr_fidp->fs.xattr.xattrwalk_fid = true;
+ xattr_fidp->fs.xattr.value = g_malloc0(size);
if (size) {
- xattr_fidp->fs.xattr.value = g_malloc0(size);
err = v9fs_co_llistxattr(pdu, &xattr_fidp->path,
xattr_fidp->fs.xattr.value,
xattr_fidp->fs.xattr.len);
@@ -3289,8 +3289,8 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque)
xattr_fidp->fs.xattr.len = size;
xattr_fidp->fid_type = P9_FID_XATTR;
xattr_fidp->fs.xattr.xattrwalk_fid = true;
+ xattr_fidp->fs.xattr.value = g_malloc0(size);
if (size) {
- xattr_fidp->fs.xattr.value = g_malloc0(size);
err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path,
&name, xattr_fidp->fs.xattr.value,
xattr_fidp->fs.xattr.len);
--
2.14.4
- [Qemu-devel] [PULL 0/7] 9p patches 2018-06-07, Greg Kurz, 2018/06/07
- [Qemu-devel] [PULL 4/7] 9p: xattr: Fix crashes due to free of uninitialized value,
Greg Kurz <=
- [Qemu-devel] [PULL 5/7] 9p: local: Avoid warning if FS_IOC_GETVERSION is not defined, Greg Kurz, 2018/06/07
- [Qemu-devel] [PULL 6/7] 9p: Properly check/translate flags in unlinkat, Greg Kurz, 2018/06/07
- [Qemu-devel] [PULL 2/7] 9p: local: Properly set errp in fstatfs error path, Greg Kurz, 2018/06/07
- [Qemu-devel] [PULL 1/7] 9p: proxy: Fix size passed to `connect`, Greg Kurz, 2018/06/07
- [Qemu-devel] [PULL 3/7] 9p: Move a couple xattr functions to 9p-util, Greg Kurz, 2018/06/07
- [Qemu-devel] [PULL 7/7] 9p: xattr: Properly translate xattrcreate flags, Greg Kurz, 2018/06/07
- Re: [Qemu-devel] [PULL 0/7] 9p patches 2018-06-07, Peter Maydell, 2018/06/08