diff mbox series

block/vmdk: prevent double-free in extent memory management

Message ID 20250304090415.39393-1-gerben@altlinux.org (mailing list archive)
State New
Headers show
Series block/vmdk: prevent double-free in extent memory management | expand

Commit Message

gerben@altlinux.org March 4, 2025, 9:04 a.m. UTC 
From: Denis Rastyogin <gerben@altlinux.org>

This error was discovered by fuzzing qemu-img.

A double-free issue in the VMDK driver occurs when handling snapshots.
The memory allocated for extent structures is freed twice: first in
vmdk_close (block/vmdk.c) and then in vmdk_add_extent (block/vmdk.c).

The fix ensures the s->extents pointer is set to NULL after freeing,
preventing double-free.

Closes: https://gitlab.com/qemu-project/qemu/-/issues/2853
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
---
 block/vmdk.c | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/block/vmdk.c b/block/vmdk.c
index 2adec49912..d6baa54602 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -285,6 +285,7 @@  static void vmdk_free_extents(BlockDriverState *bs)
     bdrv_graph_wrunlock();
 
     g_free(s->extents);
+    s->extents = NULL;
 }
 
 static void vmdk_free_last_extent(BlockDriverState *bs)