Commit 6764579f authored by Peter Maydell's avatar Peter Maydell Committed by Stefan Hajnoczi
Browse files

block/cow: Avoid use of uninitialized cow_bs in error path 



Commit 25814e89 introduced an error-exit code path which does
a "goto exit" before the cow_bs variable is initialized, meaning
we would call bdrv_unref() on an uninitialized variable and
likely segfault. Fix this by moving the NULL-initialization
to the top of the function and making the exit code path handle
the case where it is NULL.

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: default avatarEric Blake <eblake@redhat.com>
Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
parent 4caf0fcd

block/cow.c

+4 −3
Original line number Diff line number Diff line
@@ -332,7 +332,7 @@ static int cow_create(const char *filename, QemuOpts *opts, Error **errp) 
    char *image_filename = NULL;

    Error *local_err = NULL;

    int ret;

    BlockDriverState *cow_bs;

    BlockDriverState *cow_bs = NULL;



    /* Read out options */

    image_sectors = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / 512;
@@ -344,7 +344,6 @@ static int cow_create(const char *filename, QemuOpts *opts, Error **errp) 
        goto exit;

    }



    cow_bs = NULL;

    ret = bdrv_open(&cow_bs, filename, NULL, NULL,

                    BDRV_O_RDWR | BDRV_O_PROTOCOL, NULL, &local_err);

    if (ret < 0) {
@@ -383,7 +382,9 @@ static int cow_create(const char *filename, QemuOpts *opts, Error **errp) 


exit:

    g_free(image_filename);

    if (cow_bs) {

        bdrv_unref(cow_bs);

    }

    return ret;

}