• J
    qemu: Fix double free in qemuDomainSecretAESClear · 228ae709
    John Ferlan 提交于
    Commit id 02b031a4 added a secondary path from which the
    incoming @secinfo would not be free'd until the private
    data was freed in qemuDomainStorageSourcePrivateDispose.
    
    However, by doing this the original intention to free
    @*secinfo afterwards is lost and thus the pass by value
    of the secinfo->s.aes (or secinfo->s.plain for its method)
    results in not keeping the NULL setting in the various
    secret.{username|iv|ciphertext} fields upon return to
    qemuDomainSecretInfoClear and eventually will result in
    a double free at domain destroy:
    
        raise ()
        abort ()
        __libc_message ()
        malloc_printerr ()
        _int_free ()
        virFree
        qemuDomainSecretAESClear
        qemuDomainSecretInfoClear
        qemuDomainSecretInfoFree
        qemuDomainStorageSourcePrivateDispose
        virObjectUnref
        virStorageSourceClear
        virStorageSourceFree
        virDomainDiskDefFree
        virDomainDefFree
        virDomainObjRemoveTransientDef
        qemuProcessStop
        qemuDomainDestroyFlags
        virDomainDestroy
    Signed-off-by: NJohn Ferlan <jferlan@redhat.com>
    ACKed-by: NPeter Krempa <pkrempa@redhat.com>
    228ae709
qemu_domain.c 388.0 KB