[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-trivial] [PATCH] block/qcow2-snapshot: Fix a null pointer derefere
From: |
Hu Chaojian |
Subject: |
[Qemu-trivial] [PATCH] block/qcow2-snapshot: Fix a null pointer dereference in qcow2_free_snapshots |
Date: |
Thu, 10 Aug 2017 07:52:37 +0000 |
From: chaojianhu <address@hidden>
In function qcow2_do_open, if "go fail;" before calling qcow2_read_snapshots,
then snapshots
will always be NULL. When dealing with "fail:", qcow2_free_snapshots will be
called, and
s->snapshots will be dereferenced without checked.
Reported-by: chaojianhu <address@hidden>
Signed-off-by: chaojianhu <address@hidden>
---
block/qcow2-snapshot.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index 44243e0..4a8128c 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -35,6 +35,10 @@ void qcow2_free_snapshots(BlockDriverState *bs)
BDRVQcow2State *s = bs->opaque;
int i;
+ if (NULL == s->snapshots) {
+ return;
+ }
+
for(i = 0; i < s->nb_snapshots; i++) {
g_free(s->snapshots[i].name);
g_free(s->snapshots[i].id_str);
--
1.9.1
- [Qemu-trivial] [PATCH] block/qcow2-snapshot: Fix a null pointer dereference in qcow2_free_snapshots,
Hu Chaojian <=