[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-trivial] [Qemu-devel] [PATCH] dump: fix use-after-free for s->
From: |
Gonglei |
Subject: |
Re: [Qemu-trivial] [Qemu-devel] [PATCH] dump: fix use-after-free for s->fd |
Date: |
Thu, 30 Oct 2014 08:54:57 +0800 |
User-agent: |
Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20120327 Thunderbird/11.0.1 |
On 2014/10/29 23:00, Markus Armbruster wrote:
> <address@hidden> writes:
>
>> From: Gonglei <address@hidden>
>>
>> After commit 4c7e251a (), when dump memory completed,
>> the s->fd will be closed twice. We should return
>> directly when dump completed.
>>
>> Signed-off-by: Gonglei <address@hidden>
>> ---
>> dump.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/dump.c b/dump.c
>> index 06a4915..9d9a409 100644
>> --- a/dump.c
>> +++ b/dump.c
>> @@ -626,6 +626,7 @@ static void dump_iterate(DumpState *s, Error **errp)
>> ret = get_next_block(s, block);
>> if (ret == 1) {
>> dump_completed(s);
>> + return;
>> }
>> }
>> }
>
> What about less tortuous control structure?
>
> do {
> block = s->next_block;
>
> size = block->target_end - block->target_start;
> if (s->has_filter) {
> size -= s->start;
> if (s->begin + s->length < block->target_end) {
> size -= block->target_end - (s->begin + s->length);
> }
> }
> write_memory(s, block, s->start, size, &local_err);
> if (local_err) {
> error_propagate(errp, local_err);
> return;
> }
>
> } while (!get_next_block(s, block))
>
> dump_completed();
>
> Makes the badly chosen return values of of get_next_block() more
> visible. Easy enough to fix if it bothers you.
Looks better. v2 will be posted, thanks :)
Best regards,
-Gonglei