]> git.ipfire.org Git - thirdparty/libvirt.git/commit
qemuBlockJobProcessEventCompletedPull: Avoid dangling pointer after blockpull
authorPeter Krempa <pkrempa@redhat.com>
Mon, 12 Apr 2021 15:24:22 +0000 (17:24 +0200)
committerPeter Krempa <pkrempa@redhat.com>
Tue, 13 Apr 2021 08:58:25 +0000 (10:58 +0200)
commit46e748aa02cbd5923fa4b500352f528de35dc665
tree6269fb2c4d99303e76d92211bce9ccf7e5539309
parentb3605a4d830dc7fb99cf800c8512130744842b4d
qemuBlockJobProcessEventCompletedPull: Avoid dangling pointer after blockpull

When doing a full block pull job (base == NULL) and the config XML
contains a compatible disk, the completer function would leave a
dangling pointer in 'cfgdisk->src->backingStore' as cfgdisk->src would
be set to the value of 'cfgbase' which was always set to
'cfgdisk->src->backingStore'.

This is wrong though since for the live definition XML we set the
respective counterpart to 'job->data.pull.base' which is NULL in the
above scenario.

This leads to a invalid pointer read when saving the config XML and may
end up in a crash.

Resolve it by setting 'cfgbase' only when 'job->data.pull.base' is
non-NULL.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1946918
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
src/qemu/qemu_blockjob.c