david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

replay: Fix dangling location bug in replay_configure()

Browse Source 
replay_configure() pushes and pops a Location with automatic storage
duration.  Except it fails to pop when -icount parameter "rr" isn't
given.  cur_loc then points to unused stack space, and will most
likely get clobbered in short order.

Clobbered cur_loc can make loc_pop() and error_print_loc() crash or
report bogus locations.

Broken in commit 890ad55.

I didn't take the time to find a reproducer.

Cc: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <1461767349-15329-3-git-send-email-armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
This commit is contained in:
Markus Armbruster 2016-04-27 16:29:08 +02:00
parent 37f32349ea
commit d9d3aaea0b
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
replay/replay.c
View File

@ -275,7 +275,7 @@ void replay_configure(QemuOpts *opts)
rr = qemu_opt_get(opts, "rr");
if (!rr) {
/* Just enabling icount */
return;
goto out;
} else if (!strcmp(rr, "record")) {
mode = REPLAY_MODE_RECORD;
} else if (!strcmp(rr, "replay")) {
@ -293,6 +293,7 @@ void replay_configure(QemuOpts *opts)
replay_enable(fname, mode);
out:
loc_pop(&loc);
}