ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tests/qtest/libqos/ahci.c: Avoid NULL dereference in ahci_exec() 

In ahci_exec() we attempt to permit the caller to pass a NULL pointer
for opts_in (in which case we use a default set of options).  However
although we check for NULL when setting up the opts variable at the
top of the function, we unconditionally dereference opts_in at the
end of the function as part of freeing the opts->buffer.

Switch to checking whether the final buffer is the same as the
buffer we started with, instead of assuming the value we started
with is always opts_in->buffer.

At the moment all the callers pass a non-NULL opts argument, so
we never saw any crashes in practice.

Fixes: Coverity CID 1432302
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20201103115257.23623-1-peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Peter Maydell 2020-11-03 11:52:57 +00:00 committed by Paolo Bonzini
parent 1d72d9c487
commit 0250edf1eb
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
tests/qtest/libqos/ahci.c
View File

@ -637,10 +637,13 @@ void ahci_exec(AHCIQState *ahci, uint8_t port,
AHCICommand *cmd;
int rc;
AHCIOpts *opts;
uint64_t buffer_in;
opts = g_memdup((opts_in == NULL ? &default_opts : opts_in),
sizeof(AHCIOpts));
buffer_in = opts->buffer;
/* No guest buffer provided, create one. */
if (opts->size && !opts->buffer) {
opts->buffer = ahci_alloc(ahci, opts->size);
@ -686,7 +689,7 @@ void ahci_exec(AHCIQState *ahci, uint8_t port,
g_assert_cmpint(rc, ==, 0);
}
ahci_command_free(cmd);
if (opts->buffer != opts_in->buffer) {
if (opts->buffer != buffer_in) {
ahci_free(ahci, opts->buffer);
}
g_free(opts);