ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

vvfat: Fix double free for opening the image rw 

Allocation and deallocation of bs->opaque is not in the control of a
block driver. Therefore it should not set bs->opaque to a data structure
used by another bs, or closing the image will lead to a double free.

Signed-off-by: Kevin Wolf <mail@kevin-wolf.de>
This commit is contained in:
Kevin Wolf 2010-09-10 12:27:03 +02:00 committed by Kevin Wolf
parent ac48e389d0
commit 9217e26f43
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
block/vvfat.c
View File

@ -2768,12 +2768,12 @@ static int vvfat_is_allocated(BlockDriverState *bs,
static int write_target_commit(BlockDriverState *bs, int64_t sector_num, static int write_target_commit(BlockDriverState *bs, int64_t sector_num,
const uint8_t* buffer, int nb_sectors) { const uint8_t* buffer, int nb_sectors) {
BDRVVVFATState* s = bs->opaque; BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
return try_commit(s); return try_commit(s);
} }
static void write_target_close(BlockDriverState *bs) { static void write_target_close(BlockDriverState *bs) {
BDRVVVFATState* s = bs->opaque; BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
bdrv_delete(s->qcow); bdrv_delete(s->qcow);
free(s->qcow_filename); free(s->qcow_filename);
} }
@ -2816,7 +2816,8 @@ static int enable_write_target(BDRVVVFATState *s)
s->bs->backing_hd = calloc(sizeof(BlockDriverState), 1); s->bs->backing_hd = calloc(sizeof(BlockDriverState), 1);
s->bs->backing_hd->drv = &vvfat_write_target; s->bs->backing_hd->drv = &vvfat_write_target;
s->bs->backing_hd->opaque = s; s->bs->backing_hd->opaque = qemu_malloc(sizeof(void*));
*(void**)s->bs->backing_hd->opaque = s;
return 0; return 0;
} }