From 46fe53ae905497a84d33065a9d8c31c9cd0c44bf Mon Sep 17 00:00:00 2001
Message-Id: <46fe53ae905497a84d33065a9d8c31c9cd0c44bf@dist-git>
From: Peter Krempa <pkrempa@redhat.com>
Date: Fri, 19 Jul 2019 15:34:53 +0200
Subject: [PATCH] util: storage: Don't leak metadata on repeated calls of
 virStorageFileGetMetadata
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When querying storage metadata after a block job we re-run
virStorageFileGetMetadata on the top level storage file. This means that
the workers (virStorageFileGetMetadataInternal) must not overwrite any
pointers without freeing them.

This was not considered for src->compat and src->features. Fix it and
add a comment mentioning that.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
(cherry picked from commit f0430d069af991475de6fa83ed62a45f8669c645)
https: //bugzilla.redhat.com/show_bug.cgi?id=1731329
Message-Id: <80801e221bea1a4e33fbdd62845d790e390a1632.1563542241.git.pkrempa@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
---
 src/util/virstoragefile.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c
index f516a7c7f3..0187c8d2c9 100644
--- a/src/util/virstoragefile.c
+++ b/src/util/virstoragefile.c
@@ -961,7 +961,11 @@ virStorageFileGetEncryptionPayloadOffset(const struct FileEncryptionInfo *info,
  * assuming it has the given FORMAT, populate information into META
  * with information about the file and its backing store. Return format
  * of the backing store as BACKING_FORMAT. PATH and FORMAT have to be
- * pre-populated in META */
+ * pre-populated in META.
+ *
+ * Note that this function may be called repeatedly on @meta, so it must
+ * clean up any existing allocated memory which would be overwritten.
+ */
 int
 virStorageFileGetMetadataInternal(virStorageSourcePtr meta,
                                   char *buf,
@@ -1048,10 +1052,13 @@ virStorageFileGetMetadataInternal(virStorageSourcePtr meta,
             return -1;
     }
 
+    virBitmapFree(meta->features);
+    meta->features = NULL;
     if (fileTypeInfo[meta->format].getFeatures != NULL &&
         fileTypeInfo[meta->format].getFeatures(&meta->features, meta->format, buf, len) < 0)
         return -1;
 
+    VIR_FREE(meta->compat);
     if (meta->format == VIR_STORAGE_FILE_QCOW2 && meta->features &&
         VIR_STRDUP(meta->compat, "1.1") < 0)
         return -1;
-- 
2.22.1