aboutsummaryrefslogtreecommitdiff
path: root/block/vvfat.c
diff options
context:
space:
mode:
authorKevin Wolf <mail@kevin-wolf.de>2010-09-10 12:27:03 +0200
committerKevin Wolf <kwolf@redhat.com>2010-09-21 15:39:42 +0200
commit9217e26f43df4aab7deaea35b21caacc1f1f854b (patch)
tree49a5d0c5ac30f47465d93489d7933b418c8eda2a /block/vvfat.c
parentac48e389d073bf2c8703745eef4824fabe0427ba (diff)
downloadqemu-9217e26f43df4aab7deaea35b21caacc1f1f854b.zip
qemu-9217e26f43df4aab7deaea35b21caacc1f1f854b.tar.gz
qemu-9217e26f43df4aab7deaea35b21caacc1f1f854b.tar.bz2
vvfat: Fix double free for opening the image rw
Allocation and deallocation of bs->opaque is not in the control of a block driver. Therefore it should not set bs->opaque to a data structure used by another bs, or closing the image will lead to a double free. Signed-off-by: Kevin Wolf <mail@kevin-wolf.de>
Diffstat (limited to 'block/vvfat.c')
-rw-r--r--block/vvfat.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/block/vvfat.c b/block/vvfat.c
index 5898d66..0772037 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -2768,12 +2768,12 @@ static int vvfat_is_allocated(BlockDriverState *bs,
static int write_target_commit(BlockDriverState *bs, int64_t sector_num,
const uint8_t* buffer, int nb_sectors) {
- BDRVVVFATState* s = bs->opaque;
+ BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
return try_commit(s);
}
static void write_target_close(BlockDriverState *bs) {
- BDRVVVFATState* s = bs->opaque;
+ BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
bdrv_delete(s->qcow);
free(s->qcow_filename);
}
@@ -2816,7 +2816,8 @@ static int enable_write_target(BDRVVVFATState *s)
s->bs->backing_hd = calloc(sizeof(BlockDriverState), 1);
s->bs->backing_hd->drv = &vvfat_write_target;
- s->bs->backing_hd->opaque = s;
+ s->bs->backing_hd->opaque = qemu_malloc(sizeof(void*));
+ *(void**)s->bs->backing_hd->opaque = s;
return 0;
}