vitalif
/
mirror_qemu
mirror of https://github.com/proxmox/mirror_qemu
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

hw/xen: Fix double-free in xen_console store_con_info() 

Coverity spotted a double-free (CID 1508254); we g_string_free(path) and
then for some reason immediately call free(path) too.

We should just use g_autoptr() for it anyway, which simplifies the code
a bit.

Fixes: 7a8a749da7 ("hw/xen: Move xenstore_store_pv_console_info to xen_console.c")
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
master
David Woodhouse 2023-04-12 19:51:01 +01:00 committed by Peter Maydell
parent 9d177b7f87
commit 69d4e746b3
1 changed files with 3 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
hw/char/xen_console.c
View File

@ -178,8 +178,7 @@ static int store_con_info(struct XenConsole *con)
Chardev *cs = qemu_chr_fe_get_driver(&con->chr);
char *pts = NULL;
char *dom_path;
GString *path;
int ret = -1;
g_autoptr(GString) path = NULL;
/* Only continue if we're talking to a pty. */
if (!CHARDEV_IS_PTY(cs)) {
@ -204,15 +203,9 @@ static int store_con_info(struct XenConsole *con)
if (xenstore_write_str(con->console, path->str, pts)) {
fprintf(stderr, "xenstore_write_str for '%s' fail", path->str);
goto out;
return -1;
}
ret = 0;
out:
g_string_free(path, true);
free(path);
return ret;
return 0;
}
static int con_init(struct XenLegacyDevice *xendev)