From 998cbd6a44cd96044f56713274bdf6a94cd721c0 Mon Sep 17 00:00:00 2001 From: Manos Pitsidianakis Date: Fri, 14 Jul 2017 17:35:47 +0300 Subject: block: fix dangling bs->explicit_options in block.c In some error paths it is possible to QDECREF a freed dangling explicit_options, resulting in a heap overflow crash. For example bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls bdrv_close which also unrefs it. Signed-off-by: Manos Pitsidianakis Signed-off-by: Kevin Wolf --- block.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/block.c b/block.c index 37e72b7a96..7a78bc647b 100644 --- a/block.c +++ b/block.c @@ -2608,6 +2608,7 @@ fail: QDECREF(bs->options); QDECREF(options); bs->options = NULL; + bs->explicit_options = NULL; bdrv_unref(bs); error_propagate(errp, local_err); return NULL; @@ -3087,6 +3088,7 @@ static void bdrv_close(BlockDriverState *bs) QDECREF(bs->options); QDECREF(bs->explicit_options); bs->options = NULL; + bs->explicit_options = NULL; QDECREF(bs->full_open_options); bs->full_open_options = NULL; } -- cgit v1.2.3