Skip to content

Commit

Permalink
hw/xen: Fix double-free in xen_console store_con_info()
Browse files Browse the repository at this point in the history
Coverity spotted a double-free (CID 1508254); we g_string_free(path) and
then for some reason immediately call free(path) too.

We should just use g_autoptr() for it anyway, which simplifies the code
a bit.

Fixes: 7a8a749 ("hw/xen: Move xenstore_store_pv_console_info to xen_console.c")
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
  • Loading branch information
dwmw2 authored and pm215 committed Apr 13, 2023
1 parent 9d177b7 commit 69d4e74
Showing 1 changed file with 3 additions and 10 deletions.
13 changes: 3 additions & 10 deletions hw/char/xen_console.c
Original file line number Diff line number Diff line change
Expand Up @@ -178,8 +178,7 @@ static int store_con_info(struct XenConsole *con)
Chardev *cs = qemu_chr_fe_get_driver(&con->chr);
char *pts = NULL;
char *dom_path;
GString *path;
int ret = -1;
g_autoptr(GString) path = NULL;

/* Only continue if we're talking to a pty. */
if (!CHARDEV_IS_PTY(cs)) {
Expand All @@ -204,15 +203,9 @@ static int store_con_info(struct XenConsole *con)

if (xenstore_write_str(con->console, path->str, pts)) {
fprintf(stderr, "xenstore_write_str for '%s' fail", path->str);
goto out;
return -1;
}
ret = 0;

out:
g_string_free(path, true);
free(path);

return ret;
return 0;
}

static int con_init(struct XenLegacyDevice *xendev)
Expand Down

0 comments on commit 69d4e74

Please sign in to comment.