starred/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-04-05 22:00:58 +00:00
Code Issues 380 Packages Projects Releases Wiki Activity

xen-block: remove NULL pointer dereference

Browse Source 
If params is NULL, xen_block_drive_create calls xen_block_drive_destroy
with drive == NULL.

Reported-by: Siteshwar Vashisht <svashisht@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini
2026-03-02 13:37:59 +01:00
parent 1ae4271ab8
commit ef586b5ad5
1 changed files with 19 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
hw/block/xen-block.c
View File

@@ -883,32 +883,29 @@ static XenBlockDrive *xen_block_drive_create(const char *id,
QDict *driver_layer;
struct stat st;
int rc;
char **v;
if (params) {
char **v = g_strsplit(params, ":", 2);
if (v[1] == NULL) {
filename = g_strdup(v[0]);
driver = g_strdup("raw");
} else {
if (strcmp(v[0], "aio") == 0) {
driver = g_strdup("raw");
} else if (strcmp(v[0], "vhd") == 0) {
driver = g_strdup("vpc");
} else {
driver = g_strdup(v[0]);
}
filename = g_strdup(v[1]);
}
g_strfreev(v);
} else {
if (!params) {
error_setg(errp, "no params");
goto done;
return NULL;
}
assert(filename);
assert(driver);
v = g_strsplit(params, ":", 2);
if (v[1] == NULL) {
filename = g_strdup(v[0]);
driver = g_strdup("raw");
} else {
if (strcmp(v[0], "aio") == 0) {
driver = g_strdup("raw");
} else if (strcmp(v[0], "vhd") == 0) {
driver = g_strdup("vpc");
} else {
driver = g_strdup(v[0]);
}
filename = g_strdup(v[1]);
}
g_strfreev(v);
drive = g_new0(XenBlockDrive, 1);
drive->id = g_strdup(id);