[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-trivial] [Qemu-devel] [PATCH] dump: fix use-after-free for s->
From: |
Markus Armbruster |
Subject: |
Re: [Qemu-trivial] [Qemu-devel] [PATCH] dump: fix use-after-free for s->fd |
Date: |
Wed, 29 Oct 2014 16:00:50 +0100 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) |
<address@hidden> writes:
> From: Gonglei <address@hidden>
>
> After commit 4c7e251a (), when dump memory completed,
> the s->fd will be closed twice. We should return
> directly when dump completed.
>
> Signed-off-by: Gonglei <address@hidden>
> ---
> dump.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/dump.c b/dump.c
> index 06a4915..9d9a409 100644
> --- a/dump.c
> +++ b/dump.c
> @@ -626,6 +626,7 @@ static void dump_iterate(DumpState *s, Error **errp)
> ret = get_next_block(s, block);
> if (ret == 1) {
> dump_completed(s);
> + return;
> }
> }
> }
What about less tortuous control structure?
do {
block = s->next_block;
size = block->target_end - block->target_start;
if (s->has_filter) {
size -= s->start;
if (s->begin + s->length < block->target_end) {
size -= block->target_end - (s->begin + s->length);
}
}
write_memory(s, block, s->start, size, &local_err);
if (local_err) {
error_propagate(errp, local_err);
return;
}
} while (!get_next_block(s, block))
dump_completed();
Makes the badly chosen return values of of get_next_block() more
visible. Easy enough to fix if it bothers you.