[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 10/20] tests/qtest/libqos/ahci.c: Avoid NULL dereference in ahci_e
From: |
Paolo Bonzini |
Subject: |
[PULL 10/20] tests/qtest/libqos/ahci.c: Avoid NULL dereference in ahci_exec() |
Date: |
Wed, 4 Nov 2020 10:01:43 -0500 |
From: Peter Maydell <peter.maydell@linaro.org>
In ahci_exec() we attempt to permit the caller to pass a NULL pointer
for opts_in (in which case we use a default set of options). However
although we check for NULL when setting up the opts variable at the
top of the function, we unconditionally dereference opts_in at the
end of the function as part of freeing the opts->buffer.
Switch to checking whether the final buffer is the same as the
buffer we started with, instead of assuming the value we started
with is always opts_in->buffer.
At the moment all the callers pass a non-NULL opts argument, so
we never saw any crashes in practice.
Fixes: Coverity CID 1432302
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20201103115257.23623-1-peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
tests/qtest/libqos/ahci.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tests/qtest/libqos/ahci.c b/tests/qtest/libqos/ahci.c
index 2946abc15a..fba3e7a954 100644
--- a/tests/qtest/libqos/ahci.c
+++ b/tests/qtest/libqos/ahci.c
@@ -637,10 +637,13 @@ void ahci_exec(AHCIQState *ahci, uint8_t port,
AHCICommand *cmd;
int rc;
AHCIOpts *opts;
+ uint64_t buffer_in;
opts = g_memdup((opts_in == NULL ? &default_opts : opts_in),
sizeof(AHCIOpts));
+ buffer_in = opts->buffer;
+
/* No guest buffer provided, create one. */
if (opts->size && !opts->buffer) {
opts->buffer = ahci_alloc(ahci, opts->size);
@@ -686,7 +689,7 @@ void ahci_exec(AHCIQState *ahci, uint8_t port,
g_assert_cmpint(rc, ==, 0);
}
ahci_command_free(cmd);
- if (opts->buffer != opts_in->buffer) {
+ if (opts->buffer != buffer_in) {
ahci_free(ahci, opts->buffer);
}
g_free(opts);
--
2.26.2
- [PULL 00/20] Misc patches for QEMU 5.2-rc1, Paolo Bonzini, 2020/11/04
- [PULL 03/20] exec: Remove dead code (CID 1432876), Paolo Bonzini, 2020/11/04
- [PULL 01/20] cutils: replace strdup with g_strdup, Paolo Bonzini, 2020/11/04
- [PULL 09/20] tests/qtest/libqtest.c: Check for setsockopt() failure, Paolo Bonzini, 2020/11/04
- [PULL 02/20] docs: expand sourceset documentation, Paolo Bonzini, 2020/11/04
- [PULL 07/20] meson: use b_staticpic=false for meson >=0.56.0, Paolo Bonzini, 2020/11/04
- [PULL 10/20] tests/qtest/libqos/ahci.c: Avoid NULL dereference in ahci_exec(),
Paolo Bonzini <=
- [PULL 06/20] qtest: add a reproducer for LP#1878642, Paolo Bonzini, 2020/11/04
- [PULL 12/20] configure: fix gio_libs reference, Paolo Bonzini, 2020/11/04
- [PULL 04/20] scripts/oss-fuzz: rename bin/qemu-fuzz-i386, Paolo Bonzini, 2020/11/04
- [PULL 16/20] fuzz: fuzz offsets within pio/mmio regions, Paolo Bonzini, 2020/11/04
- [PULL 08/20] meson: vhost-user-gpu/virtiofsd: use absolute path, Paolo Bonzini, 2020/11/04
- [PULL 05/20] hw/isa/lpc_ich9: Ignore reserved/invalid SCI IRQ, Paolo Bonzini, 2020/11/04
- [PULL 15/20] fuzz: check the MR in the DMA callback, Paolo Bonzini, 2020/11/04
- [PULL 11/20] meson: fix warning for bad sphinx-build, Paolo Bonzini, 2020/11/04
- [PULL 14/20] fuzz: fix writing DMA patterns, Paolo Bonzini, 2020/11/04
- [PULL 17/20] semihosting: fix order of initialization functions, Paolo Bonzini, 2020/11/04