diff mbox

[stable-0.15,09/36] block: Fix bdrv_open use after free

Message ID 1332939159-16434-10-git-send-email-afaerber@suse.de
State New
Headers show

Commit Message

Andreas Färber March 28, 2012, 12:52 p.m. UTC 
From: Kevin Wolf <kwolf@redhat.com>

tmp_filename was used outside the block it was defined in, i.e. after it went
out of scope. Move its declaration to the top level.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 2b5728164fcf5211bbae8d3c2fc6df62dd6b2295)

Signed-off-by: Bruce Rogers <brogers@suse.com>
Signed-off-by: Andreas Färber <afaerber@suse.de>
---
 block.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
diff mbox

Patch

diff --git a/block.c b/block.c
index 9549b9e..4ebb18b 100644
--- a/block.c
+++ b/block.c
@@ -526,6 +526,7 @@  int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
               BlockDriver *drv)
 {
     int ret;
+    char tmp_filename[PATH_MAX];
 
     if (flags & BDRV_O_SNAPSHOT) {
         BlockDriverState *bs1;
@@ -533,7 +534,6 @@  int bdrv_open(BlockDriverState *bs, const char *filename, int flags,
         int is_protocol = 0;
         BlockDriver *bdrv_qcow2;
         QEMUOptionParameter *options;
-        char tmp_filename[PATH_MAX];
         char backing_filename[PATH_MAX];
 
         /* if snapshot, we create a temporary backing file and open it