From c4f4e195a14c86b7daff2c45f1cbfd23ac16aaa8 Mon Sep 17 00:00:00 2001 From: Tuguoyi Date: Tue, 24 Nov 2020 03:12:00 +0000 Subject: [PATCH] qemu_conf: Fix double free problem for cfg->firmwares MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cfg->firmwares still points to the original memory address after being freed by virFirmwareFreeList(). As cfg get freed, it will be freed again even if cfg->nfirmwares=0 which eventually lead to crash. The patch fix it by setting cfg->firmwares to NULL explicitly after virFirmwareFreeList() returns Signed-off-by: Guoyi Tu Reviewed-by: Ján Tomko --- src/qemu/qemu_conf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index d6615ca0dd..cbdde0c0dc 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -834,6 +834,7 @@ virQEMUDriverConfigLoadNVRAMEntry(virQEMUDriverConfigPtr cfg, VIR_AUTOSTRINGLIST fwList = NULL; virFirmwareFreeList(cfg->firmwares, cfg->nfirmwares); + cfg->firmwares = NULL; if (qemuFirmwareFetchConfigs(&fwList, privileged) < 0) return -1;