From 48e1b49353a5700427288185ca12c301ef2cfa3a Mon Sep 17 00:00:00 2001 From: Peter Krempa Date: Thu, 8 Sep 2022 16:31:58 +0200 Subject: [PATCH] virConnectOpenInternal: Avoid double free() when alias is an invalid URI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Configuring an URI alias such as uri_aliases = [ "blah=qemu://invaliduri@@@", ] Results in a double free when the alias is used: $ virsh -c blah free(): double free detected in tcache 2 Aborted (core dumped) This happens as the 'alias' variable is first assigned to 'uristr' which is cleared in the 'failed' label and then is explicitly freed again. Fix this by stealing the alias into 'uristr' and removing the unnecessary freeing. Signed-off-by: Peter Krempa Reviewed-by: Ján Tomko --- src/libvirt.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index b78b49a632..19379a2a53 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -940,14 +940,12 @@ virConnectOpenInternal(const char *name, goto failed; if (alias) { - VIR_FREE(uristr); - uristr = alias; + g_free(uristr); + uristr = g_steal_pointer(&alias); } - if (!(ret->uri = virURIParse(uristr))) { - VIR_FREE(alias); + if (!(ret->uri = virURIParse(uristr))) goto failed; - } /* Avoid need for drivers to worry about NULLs, as * no one needs to distinguish "" vs NULL */