dcavalca / rpms / qemu

Forked from rpms/qemu a year ago
Clone

Blame 0021-qiov-prevent-double-free-or-use-after-free.patch

Justin M. Forbes 45e84a
From 6061f16a8a119a46e61f2ddbabdb58f83e8857f7 Mon Sep 17 00:00:00 2001
Justin M. Forbes 45e84a
From: Paolo Bonzini <pbonzini@redhat.com>
Justin M. Forbes 45e84a
Date: Fri, 25 Nov 2011 12:06:22 +0100
Justin M. Forbes 45e84a
Subject: [PATCH 21/25] qiov: prevent double free or use-after-free
Justin M. Forbes 45e84a
Justin M. Forbes 45e84a
qemu_iovec_destroy does not clear the QEMUIOVector fully, and the data
Justin M. Forbes 45e84a
could thus be used after free or freed again.  While I do not know any
Justin M. Forbes 45e84a
example in the tree, I observed this using virtio-scsi (and SCSI
Justin M. Forbes 45e84a
scatter/gather) when canceling DMA requests.
Justin M. Forbes 45e84a
Justin M. Forbes 45e84a
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Justin M. Forbes 45e84a
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Justin M. Forbes 45e84a
---
Justin M. Forbes 45e84a
 cutils.c |    3 +++
Justin M. Forbes 45e84a
 1 files changed, 3 insertions(+), 0 deletions(-)
Justin M. Forbes 45e84a
Justin M. Forbes 45e84a
diff --git a/cutils.c b/cutils.c
Justin M. Forbes 45e84a
index 6db6304..24b3fe3 100644
Justin M. Forbes 45e84a
--- a/cutils.c
Justin M. Forbes 45e84a
+++ b/cutils.c
Justin M. Forbes 45e84a
@@ -217,7 +217,10 @@ void qemu_iovec_destroy(QEMUIOVector *qiov)
Justin M. Forbes 45e84a
 {
Justin M. Forbes 45e84a
     assert(qiov->nalloc != -1);
Justin M. Forbes 45e84a
Justin M. Forbes 45e84a
+    qemu_iovec_reset(qiov);
Justin M. Forbes 45e84a
     g_free(qiov->iov);
Justin M. Forbes 45e84a
+    qiov->nalloc = 0;
Justin M. Forbes 45e84a
+    qiov->iov = NULL;
Justin M. Forbes 45e84a
 }
Justin M. Forbes 45e84a
Justin M. Forbes 45e84a
 void qemu_iovec_reset(QEMUIOVector *qiov)
Justin M. Forbes 45e84a
-- 
Justin M. Forbes 45e84a
1.7.7.5
Justin M. Forbes 45e84a