aboutsummaryrefslogtreecommitdiff
path: root/block
diff options
context:
space:
mode:
authorKevin Wolf <kwolf@redhat.com>2018-02-16 19:14:55 +0100
committerKevin Wolf <kwolf@redhat.com>2018-03-09 15:17:47 +0100
commit71c87815f9e0386b6f3e22942adc956fd603c82f (patch)
treeb7ac8b64528d2d434a6a6e173483eaad148fb32d /block
parentab8bda76a010261ac6df2fd6e0559c3589b6e847 (diff)
downloadqemu-71c87815f9e0386b6f3e22942adc956fd603c82f.zip
qemu-71c87815f9e0386b6f3e22942adc956fd603c82f.tar.gz
qemu-71c87815f9e0386b6f3e22942adc956fd603c82f.tar.bz2
rbd: Fix use after free in qemu_rbd_set_keypairs() error path
If we want to include the invalid option name in the error message, we can't free the string earlier than that. Cc: qemu-stable@nongnu.org Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
Diffstat (limited to 'block')
-rw-r--r--block/rbd.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/block/rbd.c b/block/rbd.c
index c1275c1..c1025c8 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -268,13 +268,14 @@ static int qemu_rbd_set_keypairs(rados_t cluster, const char *keypairs_json,
key = qstring_get_str(name);
ret = rados_conf_set(cluster, key, qstring_get_str(value));
- QDECREF(name);
QDECREF(value);
if (ret < 0) {
error_setg_errno(errp, -ret, "invalid conf option %s", key);
+ QDECREF(name);
ret = -EINVAL;
break;
}
+ QDECREF(name);
}
QDECREF(keypairs);