diff mbox series

[2/2] 9p: fix leak in synth_name_to_path()

Message ID 20180209182920.29711-2-marcandre.lureau@redhat.com
State New
Headers show
Series [1/2] 9p: v9fs_path_copy() readability | expand

Commit Message

Marc-André Lureau Feb. 9, 2018, 6:29 p.m. UTC
Leak found thanks to ASAN:

Direct leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x55995789ac90 in __interceptor_malloc (/home/elmarco/src/qemu/build/x86_64-softmmu/qemu-system-x86_64+0x1510c90)
    #1 0x7f0a91190f0c in g_malloc /home/elmarco/src/gnome/glib/builddir/../glib/gmem.c:94
    #2 0x5599580a281c in v9fs_path_copy /home/elmarco/src/qemu/hw/9pfs/9p.c:196:17
    #3 0x559958f9ec5d in coroutine_trampoline /home/elmarco/src/qemu/util/coroutine-ucontext.c:116:9
    #4 0x7f0a8766ebbf  (/lib64/libc.so.6+0x50bbf)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/9pfs/9p-synth.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Greg Kurz Feb. 12, 2018, 7:47 a.m. UTC | #1
On Fri,  9 Feb 2018 19:29:20 +0100
Marc-André Lureau <marcandre.lureau@redhat.com> wrote:

> Leak found thanks to ASAN:
> 
> Direct leak of 8 byte(s) in 1 object(s) allocated from:
>     #0 0x55995789ac90 in __interceptor_malloc (/home/elmarco/src/qemu/build/x86_64-softmmu/qemu-system-x86_64+0x1510c90)
>     #1 0x7f0a91190f0c in g_malloc /home/elmarco/src/gnome/glib/builddir/../glib/gmem.c:94
>     #2 0x5599580a281c in v9fs_path_copy /home/elmarco/src/qemu/hw/9pfs/9p.c:196:17
>     #3 0x559958f9ec5d in coroutine_trampoline /home/elmarco/src/qemu/util/coroutine-ucontext.c:116:9
>     #4 0x7f0a8766ebbf  (/lib64/libc.so.6+0x50bbf)
> 
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  hw/9pfs/9p-synth.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c
> index 18082dffe8..54239c9bbf 100644
> --- a/hw/9pfs/9p-synth.c
> +++ b/hw/9pfs/9p-synth.c
> @@ -495,6 +495,7 @@ static int synth_name_to_path(FsContext *ctx, V9fsPath *dir_path,
>      }
>  out:
>      /* Copy the node pointer to fid */
> +    g_free(target->data);
>      target->data = g_memdup(&node, sizeof(void *));
>      target->size = sizeof(void *);
>      return 0;

Applied both patches.

Cheers,

--
Greg
diff mbox series

Patch

diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c
index 18082dffe8..54239c9bbf 100644
--- a/hw/9pfs/9p-synth.c
+++ b/hw/9pfs/9p-synth.c
@@ -495,6 +495,7 @@  static int synth_name_to_path(FsContext *ctx, V9fsPath *dir_path,
     }
 out:
     /* Copy the node pointer to fid */
+    g_free(target->data);
     target->data = g_memdup(&node, sizeof(void *));
     target->size = sizeof(void *);
     return 0;