[Qemu-devel] [PATCH 1/4] qcow2: Move reading nb_snapshots in qcow2_open

[Max Reitz]

Any goto fail between having read nb_snapshots (returning a non-zero
value) and allocating s->snapshots (through qcow2_read_snapshots())
results in qcow2_free_snapshots() being called, dereferencing
s->snapshots which is still NULL.

Fix this by moving the reading of nb_snapshots right before the call to
qcow2_read_snapshots().

Signed-off-by: Max Reitz <address@hidden>
---
 block/qcow2.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index 6e5d98d..3e612a8 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -558,9 +558,6 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, 
int flags,
     s->refcount_table_size =
         header.refcount_table_clusters << (s->cluster_bits - 3);
 
-    s->snapshots_offset = header.snapshots_offset;
-    s->nb_snapshots = header.nb_snapshots;
-
     /* read the level 1 table */
     s->l1_size = header.l1_size;
 
@@ -637,6 +634,9 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, 
int flags,
         bs->backing_file[len] = '\0';
     }
 
+    s->snapshots_offset = header.snapshots_offset;
+    s->nb_snapshots = header.nb_snapshots;
+
     ret = qcow2_read_snapshots(bs);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Could not read snapshots");
-- 
1.8.4.2