aboutsummaryrefslogtreecommitdiff
path: root/qga/commands-posix.c
diff options
context:
space:
mode:
authorzhanghailiang <zhang.zhanghailiang@huawei.com>2014-09-19 11:09:10 +0800
committerMichael Roth <mdroth@linux.vnet.ibm.com>2014-10-22 07:49:52 -0500
commite668d1b8545f1c79cf869bd78813cb1e52216f45 (patch)
tree2e21a821628fb72dbfb01b2beee8d93c718ac0b5 /qga/commands-posix.c
parent01a2050fa5fb3d290134b67ee82eb3ebbd91d95b (diff)
downloadqemu-e668d1b8545f1c79cf869bd78813cb1e52216f45.zip
qemu-e668d1b8545f1c79cf869bd78813cb1e52216f45.tar.gz
qemu-e668d1b8545f1c79cf869bd78813cb1e52216f45.tar.bz2
qga: Rewrite code where using readdir_r
If readdir_r fails, error_setg_errno will reference the freed pointer *dirpath*. Moreover, readdir_r may cause a buffer overflow, using readdir instead. Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'qga/commands-posix.c')
-rw-r--r--qga/commands-posix.c27
1 files changed, 15 insertions, 12 deletions
diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index 7eed7f4..f6f3e3c 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -956,7 +956,7 @@ static void build_guest_fsinfo_for_virtual_device(char const *syspath,
{
DIR *dir;
char *dirpath;
- struct dirent entry, *result;
+ struct dirent *entry;
dirpath = g_strdup_printf("%s/slaves", syspath);
dir = opendir(dirpath);
@@ -965,22 +965,24 @@ static void build_guest_fsinfo_for_virtual_device(char const *syspath,
g_free(dirpath);
return;
}
- g_free(dirpath);
for (;;) {
- if (readdir_r(dir, &entry, &result) != 0) {
- error_setg_errno(errp, errno, "readdir_r(\"%s\")", dirpath);
- break;
- }
- if (!result) {
+ errno = 0;
+ entry = readdir(dir);
+ if (entry == NULL) {
+ if (errno) {
+ error_setg_errno(errp, errno, "readdir(\"%s\")", dirpath);
+ }
break;
}
- if (entry.d_type == DT_LNK) {
- g_debug(" slave device '%s'", entry.d_name);
- dirpath = g_strdup_printf("%s/slaves/%s", syspath, entry.d_name);
- build_guest_fsinfo_for_device(dirpath, fs, errp);
- g_free(dirpath);
+ if (entry->d_type == DT_LNK) {
+ char *path;
+
+ g_debug(" slave device '%s'", entry->d_name);
+ path = g_strdup_printf("%s/slaves/%s", syspath, entry->d_name);
+ build_guest_fsinfo_for_device(path, fs, errp);
+ g_free(path);
if (*errp) {
break;
@@ -988,6 +990,7 @@ static void build_guest_fsinfo_for_virtual_device(char const *syspath,
}
}
+ g_free(dirpath);
closedir(dir);
}