From 4d080ee4034620d3832c42d804150ca8d78a4b28 Mon Sep 17 00:00:00 2001 From: Eric Blake Date: Tue, 3 May 2011 09:36:12 -0600 Subject: [PATCH] qemu: avoid null pointer dereference This code has had problems historically. As originally written, in commit 6bcf2501 (Jun 08), it could call unlink on a random string, nuking an unrelated file. Then commit 182a80b9 (Sep 09), the code was rewritten to allocate tmp, with both a use-after-free bug and a chance to call unlink(NULL). Commit e206946 (Mar 11) fixed the use-after-free, but not the NULL dereference. Thanks to clang for catching this! * src/qemu/qemu_driver.c (qemudDomainMemoryPeek): Don't call unlink on NULL. --- src/qemu/qemu_driver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 16d869d4cb..0919503455 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5355,7 +5355,8 @@ endjob: cleanup: VIR_FORCE_CLOSE(fd); - unlink (tmp); + if (tmp) + unlink(tmp); VIR_FREE(tmp); if (vm) virDomainObjUnlock(vm);