diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2014-08-15 17:59:54 +0100 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2014-08-15 18:03:26 +0100 |
| commit | 39ba3bf69c4ef4d8a8b683ee7282efd25b3f01ff (patch) | |
| tree | 8b84be5bb2e566c9778f9492410c75e31b57d596 | |
| parent | 94c83a24c1956cd50ab979725a730f7d8649ac15 (diff) | |
| download | qemu-39ba3bf69c4ef4d8a8b683ee7282efd25b3f01ff.zip qemu-39ba3bf69c4ef4d8a8b683ee7282efd25b3f01ff.tar.gz qemu-39ba3bf69c4ef4d8a8b683ee7282efd25b3f01ff.tar.bz2 | |
qcow2: fix new_blocks double-free in alloc_refcount_block()
Commit de82815db1c89da058b7fb941dab137d6d9ab738 ("qcow2: Handle failure
for potentially large allocations") introduced a double-free of
new_blocks in the alloc_refcount_block() error path.
The qemu-iotests qcow2 026 test case was failing because qemu-io
segfaulted.
Make sure new_blocks is NULL after we free it the first time.
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
| -rw-r--r-- | block/qcow2-refcount.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index d60e2fe..3b77470 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -381,6 +381,7 @@ static int alloc_refcount_block(BlockDriverState *bs, ret = bdrv_pwrite_sync(bs->file, meta_offset, new_blocks, blocks_clusters * s->cluster_size); g_free(new_blocks); + new_blocks = NULL; if (ret < 0) { goto fail_table; } |