shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-03 05:17:54 +03:00
Code Releases Activity

virdomainjob: virDomainObjInitJob: Avoid borrowing memory from 'virDomainXMLOption'

Browse Source 
The 'cb' and 'jobDataPrivateCb' pointers are stored in the job object
but made point to the memory owned by the virDomainXMLOption struct in
the callers.

Since the 'virdomainjob' module isn't in control the lifetime of the
virDomainXMLOption, which in some cases is freed before the domain job
data, freed memory would be dereferenced in some cases.

Copy the structs from virDomainXMLOption to ensure the lifetime. This is
possible since the callback functions are immutable.

Fixes: 84e9fd068c
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
This commit is contained in:
Peter Krempa 2022-09-19 10:18:14 +02:00
parent 7c35778126
commit b34c7c9104
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/conf/virdomainjob.c
View File

@ -128,8 +128,8 @@ virDomainObjInitJob(virDomainJobObj *job,
virDomainJobDataPrivateDataCallbacks *jobDataPrivateCb)
{
memset(job, 0, sizeof(*job));
job->cb = cb;
job->jobDataPrivateCb = jobDataPrivateCb;
job->cb = g_memdup(cb, sizeof(*cb));
job->jobDataPrivateCb = g_memdup(jobDataPrivateCb, sizeof(*jobDataPrivateCb));
if (virCondInit(&job->cond) < 0)
return -1;
@ -229,6 +229,9 @@ virDomainObjClearJob(virDomainJobObj *job)
if (job->cb && job->cb->freeJobPrivate)
g_clear_pointer(&job->privateData, job->cb->freeJobPrivate);
g_clear_pointer(&job->cb, g_free);
g_clear_pointer(&job->jobDataPrivateCb, g_free);
}
void