diff options
| author |   Kevin Wolf <mail@kevin-wolf.de> | 2010-09-10 12:27:03 +0200 |
|---|---|---|
| committer |   Kevin Wolf <kwolf@redhat.com> | 2010-09-13 14:35:01 +0200 |
| commit | 345a6d2b54f0c3705a088e626d24e9376ff4f233 (patch) | |
| tree | 1fedc1fb2d4b9c9c7bc25c81bcebc9c3f816ac45 | |
| parent | 1b191088aed81f1b3661b1554f98a038872a9423 (diff) | |
vvfat: Fix double free for opening the image rw
Allocation and deallocation of bs->opaque is not in the control of a
block driver. Therefore it should not set bs->opaque to a data structure
used by another bs, or closing the image will lead to a double free.
Signed-off-by: Kevin Wolf <mail@kevin-wolf.de>
(cherry picked from commit 0af1e52e93bf5da63b15f1f9596dd4c076da07dc)
| -rw-r--r-- | block/vvfat.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/block/vvfat.c b/block/vvfat.c index 5898d664b..07720371c 100644 --- a/block/vvfat.c +++ b/block/vvfat.c @@ -2768,12 +2768,12 @@ static int vvfat_is_allocated(BlockDriverState *bs, static int write_target_commit(BlockDriverState *bs, int64_t sector_num, const uint8_t* buffer, int nb_sectors) { - BDRVVVFATState* s = bs->opaque; + BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque); return try_commit(s); } static void write_target_close(BlockDriverState *bs) { - BDRVVVFATState* s = bs->opaque; + BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque); bdrv_delete(s->qcow); free(s->qcow_filename); } @@ -2816,7 +2816,8 @@ static int enable_write_target(BDRVVVFATState *s) s->bs->backing_hd = calloc(sizeof(BlockDriverState), 1); s->bs->backing_hd->drv = &vvfat_write_target; - s->bs->backing_hd->opaque = s; + s->bs->backing_hd->opaque = qemu_malloc(sizeof(void*)); + *(void**)s->bs->backing_hd->opaque = s; return 0; } |