From: Tuguoyi <tu.guoyi@h3c.com>
Date: Tue, 24 Nov 2020 03:12:00 +0000 (+0000)
Subject: qemu_conf: Fix double free problem for cfg->firmwares
X-Git-Tag: v7.0.0-rc1~387
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c4f4e195a14c86b7daff2c45f1cbfd23ac16aaa8;p=thirdparty%2Flibvirt.git

qemu_conf: Fix double free problem for cfg->firmwares

cfg->firmwares still points to the original memory address after being
freed by virFirmwareFreeList(). As cfg get freed, it will be freed again
even if cfg->nfirmwares=0 which eventually lead to crash.

The patch fix it by setting cfg->firmwares to NULL explicitly after
virFirmwareFreeList() returns

Signed-off-by: Guoyi Tu<tu.guoyi@h3c.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
---

diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
index d6615ca0dd..cbdde0c0dc 100644
--- a/src/qemu/qemu_conf.c
+++ b/src/qemu/qemu_conf.c
@@ -834,6 +834,7 @@ virQEMUDriverConfigLoadNVRAMEntry(virQEMUDriverConfigPtr cfg,
         VIR_AUTOSTRINGLIST fwList = NULL;
 
         virFirmwareFreeList(cfg->firmwares, cfg->nfirmwares);
+        cfg->firmwares = NULL;
 
         if (qemuFirmwareFetchConfigs(&fwList, privileged) < 0)
             return -1;