Commit 71c87815 authored by Kevin Wolf's avatar Kevin Wolf
Browse files

rbd: Fix use after free in qemu_rbd_set_keypairs() error path 



If we want to include the invalid option name in the error message, we
can't free the string earlier than that.

Cc: qemu-stable@nongnu.org
Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
Reviewed-by: default avatarMax Reitz <mreitz@redhat.com>
Reviewed-by: default avatarEric Blake <eblake@redhat.com>
parent ab8bda76

block/rbd.c

+2 −1
Original line number Diff line number Diff line
@@ -268,13 +268,14 @@ static int qemu_rbd_set_keypairs(rados_t cluster, const char *keypairs_json, 
        key = qstring_get_str(name);



        ret = rados_conf_set(cluster, key, qstring_get_str(value));

        QDECREF(name);

        QDECREF(value);

        if (ret < 0) {

            error_setg_errno(errp, -ret, "invalid conf option %s", key);

            QDECREF(name);

            ret = -EINVAL;

            break;

        }

        QDECREF(name);

    }



    QDECREF(keypairs);