From: Kristina Hanicova <khanicov@redhat.com>
Date: Thu, 29 Sep 2022 11:56:30 +0000 (+0200)
Subject: virdomainjob: preserveJob: memdup the cb structure instead of copying it
X-Git-Tag: v8.8.0-rc2~4
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ba884de786e07e2a3addd68f2e587e306ee16cab;p=thirdparty%2Flibvirt.git

virdomainjob: preserveJob: memdup the cb structure instead of copying it

In case of variable 'oldjob' (job structure) in
qemuProcessReconnect() the cb pointer was just copied from the
existing job structure in virDomainObjPreserveJob(). This caused
the job and oldjob sharing the same pointer, which was later
freed at the end of the qemuProcessReconnect() function by
automatic call to virDomainObjClearJob(). This caused an invalid
read in and subsequent daemon crash as the job structure was
trying to read cb which had been already freed.

This patch changes the copying to g_memdup that allocates
different pointer, which can be later safely freed.

Signed-off-by: Kristina Hanicova <khanicov@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
---

diff --git a/src/conf/virdomainjob.c b/src/conf/virdomainjob.c
index aca801af38..0c67e84ef1 100644
--- a/src/conf/virdomainjob.c
+++ b/src/conf/virdomainjob.c
@@ -210,7 +210,7 @@ virDomainObjPreserveJob(virDomainJobObj *currJob,
     if (currJob->cb && currJob->cb->allocJobPrivate &&
         !(currJob->privateData = currJob->cb->allocJobPrivate()))
         return -1;
-    job->cb = currJob->cb;
+    job->cb = g_memdup(currJob->cb, sizeof(*currJob->cb));
 
     virDomainObjResetJob(currJob);
     virDomainObjResetAsyncJob(currJob);