diff options
| author | Alberto Garcia <berto@igalia.com> | 2018-09-06 17:25:41 +0300 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2018-09-25 15:50:15 +0200 |
| commit | 8961be33e8ca7e809c603223803ea66ef7ea5be7 (patch) | |
| tree | c665ac454c2a88464e16d06c67976636fbdc983c /tests/qemu-iotests/qed.py | |
| parent | e091f0e905a4481f347913420f327d427f18d9d4 (diff) | |
| download | qemu-8961be33e8ca7e809c603223803ea66ef7ea5be7.zip | |
block: Fix use after free error in bdrv_open_inherit()
When a block device is opened with BDRV_O_SNAPSHOT and the
bdrv_append_temp_snapshot() call fails then the error code path tries
to unref the already destroyed 'options' QDict.
This can be reproduced easily by setting TMPDIR to a location where
the QEMU process can't write:
$ TMPDIR=/nonexistent $QEMU -drive driver=null-co,snapshot=on
Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'tests/qemu-iotests/qed.py')
0 files changed, 0 insertions, 0 deletions