• M
    QemuOpts: Fix qemu_opts_foreach() dangling location regression · 37f32349
    Markus Armbruster 提交于
    qemu_opts_foreach() pushes and pops a Location with automatic storage
    duration.  Except it fails to pop when @func() returns non-zero.
    cur_loc then points to unused stack space, and will most likely get
    clobbered in short order.
    
    Clobbered cur_loc can make loc_pop() and error_print_loc() crash or
    report bogus locations.
    
    Affects several qemu command line options as well as qemu-img,
    qemu-io, qemu-nbd -object, and blkdebug's configuration file.
    
    Broken in commit a4c7367f, v2.4.0.
    
    Reproducer:
        $ qemu-system-x86_64 -nodefaults -display none -object secret,id=foo,foo=bar
    
    main() reports "Property '.foo' not found" like this:
    
        if (qemu_opts_foreach(qemu_find_opts("object"),
                              user_creatable_add_opts_foreach,
                              object_create_delayed, &err)) {
            error_report_err(err);
            exit(1);
        }
    
    cur_loc then points to where qemu_opts_foreach()'s Location used to
    be, i.e. unused stack space.  With optimization, this Location doesn't
    get clobbered for me, and also happens to be the correct location.
    Without optimization, it does get clobbered in a way that makes
    error_report_err() report no location.
    Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
    Message-Id: <1461767349-15329-2-git-send-email-armbru@redhat.com>
    Reviewed-by: NEric Blake <eblake@redhat.com>
    37f32349
qemu-option.c 31.5 KB