SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

rbd: Fix use after free in qemu_rbd_set_keypairs() error path

Browse Source 
If we want to include the invalid option name in the error message, we
can't free the string earlier than that.

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
This commit is contained in:
Kevin Wolf 2018-02-16 19:14:55 +01:00
parent ab8bda76a0
commit 71c87815f9
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
block/rbd.c
View File

@ -268,13 +268,14 @@ static int qemu_rbd_set_keypairs(rados_t cluster, const char *keypairs_json,
key = qstring_get_str(name); key = qstring_get_str(name);
ret = rados_conf_set(cluster, key, qstring_get_str(value)); ret = rados_conf_set(cluster, key, qstring_get_str(value));
QDECREF(name);
QDECREF(value); QDECREF(value);
if (ret < 0) { if (ret < 0) {
error_setg_errno(errp, -ret, "invalid conf option %s", key); error_setg_errno(errp, -ret, "invalid conf option %s", key);
QDECREF(name);
ret = -EINVAL; ret = -EINVAL;
break; break;
} }
QDECREF(name);
} }
QDECREF(keypairs); QDECREF(keypairs);