public/qemu
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

util/error: Fix use-after-free errors reported by Coverity

Browse source 
Fix use-after-free errors in the code path that called error_handle(). A
call to error_handle() will now either free the passed Error 'err' or
assign it to '*errp' if '*errp' is currently NULL. This ensures that 'err'
either has been freed or is assigned to '*errp' if this function returns.
Adjust the two callers of this function to not assign the 'err' to '*errp'
themselves, since this is now handled by error_handle().

Fixes: commit 3ffef1a55c ("error: add global &error_warn destination")
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20230406154347.4100700-1-stefanb@linux.ibm.com
This commit is contained in:
Stefan Berger 2023-04-06 11:43:47 -04:00
parent 60ca584b8a
commit cc40b8b844
1 changed files with 4 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
util/error.c
View file

@ -46,6 +46,10 @@ static void error_handle(Error **errp, Error *err)
}
if (errp == &error_warn) {
warn_report_err(err);
} else if (errp && !*errp) {
*errp = err;
} else {
error_free(err);
}
}
@ -76,7 +80,6 @@ static void error_setv(Error **errp,
err->func = func;
error_handle(errp, err);
*errp = err;
errno = saved_errno;
}
@ -289,11 +292,6 @@ void error_propagate(Error **dst_errp, Error *local_err)
return;
}
error_handle(dst_errp, local_err);
if (dst_errp && !*dst_errp) {
*dst_errp = local_err;
} else {
error_free(local_err);
}
}
void error_propagate_prepend(Error **dst_errp, Error *err,