On Fri, Jul 14, 2017 at 09:42:22AM -0500, Eric Blake wrote:
On 07/14/2017 09:35 AM, Manos Pitsidianakis wrote:
In some error paths it is possible to QDECREF a freed dangling
explicit_options, resulting in a heap overflow crash. For example
bdrv_open_inherit()'s fail unrefs it, then calls
On 07/14/2017 09:35 AM, Manos Pitsidianakis wrote:
> In some error paths it is possible to QDECREF a freed dangling
> explicit_options, resulting in a heap overflow crash. For example
> bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls
> bdrv_close which also unrefs it.
>
>
In some error paths it is possible to QDECREF a freed dangling
explicit_options, resulting in a heap overflow crash. For example
bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls
bdrv_close which also unrefs it.
Signed-off-by: Manos Pitsidianakis
---