On 19/7/26 13:32, [email protected] wrote:
From: Marc-André Lureau <[email protected]>
When bdrv_snapshot_list() returns a negative error code, sn_tab is
uninitialized. The loop does not execute (since i=0 < negative is
false), but the code falls through to g_free(sn_tab) which frees
an uninitialized pointer.
Fixes: f6baed3d1485 ("replay: implement replay-seek command")
Signed-off-by: Marc-Andre Lureau <[email protected]>
---
replay/replay-debugging.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
diff --git a/replay/replay-debugging.c b/replay/replay-debugging.c
index 11053640021..7b904a14165 100644
--- a/replay/replay-debugging.c
+++ b/replay/replay-debugging.c
@@ -139,9 +139,8 @@ static char *replay_find_nearest_snapshot(int64_t icount,
int64_t *snapshot_icount)
{
BlockDriverState *bs;
- QEMUSnapshotInfo *sn_tab;
+ g_autofree QEMUSnapshotInfo *sn_tab = NULL;
QEMUSnapshotInfo *nearest = NULL;
- char *ret = NULL;
int rv;
int nb_sns, i;
@@ -149,15 +148,19 @@ static char *replay_find_nearest_snapshot(int64_t icount,
bs = bdrv_all_find_vmstate_bs(NULL, false, NULL, NULL);
if (!bs) {
- goto fail;
+ return NULL;
}
nb_sns = bdrv_snapshot_list(bs, &sn_tab);
+ if (nb_sns < 0) {
+ return NULL;
+ }
for (i = 0; i < nb_sns; i++) {
rv = bdrv_all_has_snapshot(sn_tab[i].name, false, NULL, NULL);
- if (rv < 0)
- goto fail;
+ if (rv < 0) {
+ return NULL;
+ }
if (rv == 1) {
if (sn_tab[i].icount != -1ULL
&& sn_tab[i].icount <= icount
@@ -166,14 +169,12 @@ static char *replay_find_nearest_snapshot(int64_t icount,
}
}
}
- if (nearest) {
- ret = g_strdup(nearest->name);
- *snapshot_icount = nearest->icount;
+ if (!nearest) {
+ return NULL;
}
- g_free(sn_tab);
-fail:
- return ret;
+ *snapshot_icount = nearest->icount;
+ return g_strdup(nearest->name);
}
static void replay_seek(int64_t icount, QEMUTimerCB callback, Error **errp)
