Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.0/patches/2223082/?format=api
{ "id": 2223082, "url": "http://patchwork.ozlabs.org/api/1.0/patches/2223082/?format=api", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/1.0/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "" }, "msgid": "<20260414114033.2360-1-shentey@gmail.com>", "date": "2026-04-14T11:40:33", "name": "util/cutils: Fix heap corruption under Windows", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "d305021c10cf63ea17e08e9f09f1f594a0f88334", "submitter": { "id": 83251, "url": "http://patchwork.ozlabs.org/api/1.0/people/83251/?format=api", "name": "Bernhard Beschow", "email": "shentey@gmail.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260414114033.2360-1-shentey@gmail.com/mbox/", "series": [ { "id": 499823, "url": "http://patchwork.ozlabs.org/api/1.0/series/499823/?format=api", "date": "2026-04-14T11:40:33", "name": "util/cutils: Fix heap corruption under Windows", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/499823/mbox/" } ], "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2223082/checks/", "tags": {}, "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=fBD04iHv;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fw2Rg4w0Dz1xtJ\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 14 Apr 2026 21:41:34 +1000 (AEST)", "from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from <qemu-devel-bounces@nongnu.org>)\n\tid 1wCc8Y-0003Ml-Bv; Tue, 14 Apr 2026 07:40:58 -0400", "from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <shentey@gmail.com>) id 1wCc8X-0003MY-IM\n for qemu-devel@nongnu.org; Tue, 14 Apr 2026 07:40:57 -0400", "from mail-wm1-x334.google.com ([2a00:1450:4864:20::334])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.90_1) (envelope-from <shentey@gmail.com>) id 1wCc8W-0007XS-1j\n for qemu-devel@nongnu.org; Tue, 14 Apr 2026 07:40:57 -0400", "by mail-wm1-x334.google.com with SMTP id\n 5b1f17b1804b1-488d2079582so49600795e9.2\n for <qemu-devel@nongnu.org>; Tue, 14 Apr 2026 04:40:55 -0700 (PDT)", "from archlinux (pd9ed75d7.dip0.t-ipconnect.de. [217.237.117.215])\n by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-488d67b4a46sm267821125e9.4.2026.04.14.04.40.50\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 14 Apr 2026 04:40:51 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1776166852; x=1776771652; darn=nongnu.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=7L46d3RVA+pndHKf7BmgScwp74EmHepatmTW1GWELZg=;\n b=fBD04iHvjUJ631bvSa+sB86tDxK6yyRH8Mue0O+cL5LrBedb9tt62SYyTHiz2JI2Ou\n j4y5aSWAQoOoWDEduibJPLEFInYHlAFd823iw2v3/HjGexw9WELYCym0HTvld9UuPZ36\n YFuVh4IZtmklnpmXm06/pEQnyGmRox7DGeER/iTsrkjnoSRCDpLuzJorRI7eGt+cOqKb\n fbywqdCakYuTxK0V0R1OEgrzyDv8AUNw78bmxbRYYKCbWceDIzadKnmiaSX6yChcuTyF\n 6LSPnXYvZhVs2vfE4NL+nhppB3IKiWoy8lYz6Ii69pnXTr6gIag8QUxygghDnbuc2fvs\n CwGg==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776166852; x=1776771652;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=7L46d3RVA+pndHKf7BmgScwp74EmHepatmTW1GWELZg=;\n b=rLmafkS3t/pMKwtgPhOAms42Ju0ef4hhEdU2kOnobUQB5k8OfHJB+WjOTYNWO92IDG\n EOdas5j3D8q4WIV7OAYExB6C5LsssYlUnV3n8QYIjTDZLrKljbTWJyBo1m43ylMnDhPe\n 8/cOJKDTXgX1FpVwlE/MQ+CWZtTLC1LnujgtPp8RaaKSx7a/0ujJsTBQjqvmhUPKvva8\n Z3lt9/kqf1C6NPNvs7a5alUIJObBdpGNGV1d7B9MYC667Fekm8ZgBB0DDdKBpQGdWB2Y\n Vay5axf0PYvRDvmjPAbUiEGpaKVY6SlsSGoj/l1CWvBg3iHs8bhX6SxJRWPUPf4N9D3l\n gR5A==", "X-Gm-Message-State": "AOJu0YwBbACd+7mUq4cPhFnjVvKGV6jNTBjc254CYY+Mo0xQoz5XNrZT\n jy8ZKDFaROdzOJwGe8sRYW3FALkLNjbxoae2ajBXXOLKfXlNATTO9YPx7BZKNQ==", "X-Gm-Gg": "AeBDiesGKGdvfZ2WkGxxAxXAtvXbTi6rQh11BEgyLfSyPEu6quQj39ogBEdC+foFCyW\n 228gy6FQBSaas973GExzybGlqgIhnC3MZYidkS2LmOf05kgs6r9tRu6LG3g2UaAy234b5XrC1BN\n DcQXHeas79mLutrJV0DBSq6MaBeWLMKD0YkggMHM4ZFcqYbE7/Xs4eL3YzoQebWSMLledDCVZYw\n 0gvCBS/QsWNdKp6R+V8l44JMmSwrWIRJXqSpoMTNgq9jOz8e5btwuUwRLzfJ2HE4AfpNiAgM/Cf\n i+QK+trum2JpYBhxeiqeElccVja2T6id5XwejcvSu+Y7MIJYlHCmamjZ9qbck50eM0YNHWVCqIn\n Jf94rZfPNFsxUykmC+8i+7Fqo5FJ74CEEqIBVKe2zJbrJ2QZ0AhnKNQ8+uhfwr2rdjD4tlpTb6B\n s6ltyZfj66uTDs7dwF6K1VlnzjSd8IwGG2BQnabpfU1JE1LnyyO4HUW21dSuNnyDI=", "X-Received": "by 2002:a05:600c:3b24:b0:488:b811:51c4 with SMTP id\n 5b1f17b1804b1-488d6872ed0mr237746525e9.25.1776166851663;\n Tue, 14 Apr 2026 04:40:51 -0700 (PDT)", "From": "Bernhard Beschow <shentey@gmail.com>", "To": "qemu-devel@nongnu.org", "Cc": "Stefan Weil <sw@weilnetz.de>, Peter Maydell <peter.maydell@linaro.org>,\n Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>,\n Bernhard Beschow <shentey@gmail.com>, qemu-stable@nongnu.org", "Subject": "[PATCH] util/cutils: Fix heap corruption under Windows", "Date": "Tue, 14 Apr 2026 13:40:33 +0200", "Message-ID": "<20260414114033.2360-1-shentey@gmail.com>", "X-Mailer": "git-send-email 2.53.0", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Received-SPF": "pass client-ip=2a00:1450:4864:20::334;\n envelope-from=shentey@gmail.com; helo=mail-wm1-x334.google.com", "X-Spam_score_int": "-20", "X-Spam_score": "-2.1", "X-Spam_bar": "--", "X-Spam_report": "(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,\n RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no", "X-Spam_action": "no action", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "qemu development <qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<https://lists.nongnu.org/archive/html/qemu-devel>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org" }, "content": "Under Windows, QEMU would only sporadically start successfully. In the\nG_OS_WIN32 case, get_relocated_path() first determines a cursor\nto the end of the \"result\" string and then increases its size with\ng_string_set_size(). Since g_string_set_size() may reallocate, the\ncursor may become dangling. Windows may detect this and crash the QEMU\nprocess with the following message:\n\n HEAP: Free Heap block 000000000499B640 modified at 000000000499B684 after it was freed\n\nFurthermore, QEMU crashes spontaneously, even long after the guest has\nbooted. For example, it presumably chrashes due to the guest setting a\nnew cursor icon which may be a result of the heap corruption.\n\nFix this by determining the cursor on the resized string.\n\nFixes: cf60ccc3306c (\"cutils: Introduce bundle mechanism\")\nCc: qemu-stable@nongnu.org\nSigned-off-by: Bernhard Beschow <shentey@gmail.com>\n---\n util/cutils.c | 3 ++-\n 1 file changed, 2 insertions(+), 1 deletion(-)", "diff": "diff --git a/util/cutils.c b/util/cutils.c\nindex 9803f11a59..76a9442085 100644\n--- a/util/cutils.c\n+++ b/util/cutils.c\n@@ -1165,9 +1165,10 @@ char *get_relocated_path(const char *dir)\n \n PCWSTR wdir_skipped_root;\n if (PathCchSkipRoot(wdir, &wdir_skipped_root) == S_OK) {\n+ char *cursor;\n size = wcsrtombs(NULL, &wdir_skipped_root, 0, &(mbstate_t){0});\n- char *cursor = result->str + result->len;\n g_string_set_size(result, result->len + size);\n+ cursor = result->str + result->len - size;\n wcsrtombs(cursor, &wdir_skipped_root, size + 1, &(mbstate_t){0});\n } else {\n g_string_append(result, dir);\n", "prefixes": [] }