From: Akihiko Odaki Date: Thu, 23 Oct 2025 08:10:58 +0000 (+0900) Subject: qemu-img: Fix amend option parse error handling X-Git-Tag: v10.2.0-rc1~10^2~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f00bcc833790c72c08bc5eed97845fdaa7542507;p=thirdparty%2Fqemu.git qemu-img: Fix amend option parse error handling qemu_opts_del(opts) dereferences opts->list, which is the old amend_opts pointer that can be dangling after executing qemu_opts_append(amend_opts, bs->drv->create_opts) and cause use-after-free. Fix the potential use-after-free by moving the qemu_opts_del() call before the qemu_opts_append() call. Signed-off-by: Akihiko Odaki Message-ID: <20251023-iotests-v1-1-fab143ca4c2f@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf --- diff --git a/qemu-img.c b/qemu-img.c index a7791896c1..7a32d2d16c 100644 --- a/qemu-img.c +++ b/qemu-img.c @@ -4597,9 +4597,9 @@ static int img_amend(const img_cmd_t *ccmd, int argc, char **argv) amend_opts = qemu_opts_append(amend_opts, bs->drv->amend_opts); opts = qemu_opts_create(amend_opts, NULL, 0, &error_abort); if (!qemu_opts_do_parse(opts, options, NULL, &err)) { + qemu_opts_del(opts); /* Try to parse options using the create options */ amend_opts = qemu_opts_append(amend_opts, bs->drv->create_opts); - qemu_opts_del(opts); opts = qemu_opts_create(amend_opts, NULL, 0, &error_abort); if (qemu_opts_do_parse(opts, options, NULL, NULL)) { error_append_hint(&err,