diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2018-02-16 19:14:55 +0100 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2018-03-09 15:17:47 +0100 |
| commit | 71c87815f9e0386b6f3e22942adc956fd603c82f (patch) | |
| tree | b7ac8b64528d2d434a6a6e173483eaad148fb32d /block/rbd.c | |
| parent | ab8bda76a010261ac6df2fd6e0559c3589b6e847 (diff) | |
| download | qemu-71c87815f9e0386b6f3e22942adc956fd603c82f.tar.gz | |
rbd: Fix use after free in qemu_rbd_set_keypairs() error path
If we want to include the invalid option name in the error message, we
can't free the string earlier than that.
Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Diffstat (limited to 'block/rbd.c')
| -rw-r--r-- | block/rbd.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/block/rbd.c b/block/rbd.c index c1275c1ec9..c1025c8493 100644 --- a/block/rbd.c +++ b/block/rbd.c @@ -268,13 +268,14 @@ static int qemu_rbd_set_keypairs(rados_t cluster, const char *keypairs_json, key = qstring_get_str(name); ret = rados_conf_set(cluster, key, qstring_get_str(value)); - QDECREF(name); QDECREF(value); if (ret < 0) { error_setg_errno(errp, -ret, "invalid conf option %s", key); + QDECREF(name); ret = -EINVAL; break; } + QDECREF(name); } QDECREF(keypairs); |