-
Manos Pitsidianakis authored
In some error paths it is possible to QDECREF a freed dangling explicit_options, resulting in a heap overflow crash. For example bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls bdrv_close which also unrefs it. Signed-off-by:
Manos Pitsidianakis <el13635@mail.ntua.gr>
Signed-off-by:
Kevin Wolf <kwolf@redhat.com>Manos Pitsidianakis authoredIn some error paths it is possible to QDECREF a freed dangling explicit_options, resulting in a heap overflow crash. For example bdrv_open_inherit()'s fail unrefs it, then calls bdrv_unref which calls bdrv_close which also unrefs it. Signed-off-by:
Manos Pitsidianakis <el13635@mail.ntua.gr>
Signed-off-by:
Kevin Wolf <kwolf@redhat.com>
Loading