mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2024-11-24 03:13:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

usb-redirect: Avoid double free of data

Browse Source 
If dropping packets, data is freed, the caller's loop should not continue.

Reported by ccc-analyzer.

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 1456301288-1592-1-git-send-email-famz@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Fam Zheng 2016-02-24 16:08:08 +08:00 committed by Gerd Hoffmann
parent beded0ff7f
commit e8ce12d9ea
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hw/usb/redirect.c
View File

@ -447,7 +447,7 @@ static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
return p;
}
static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
uint8_t status, uint8_t ep, void *free_on_destroy)
{
struct buf_packet *bufp;
@ -464,7 +464,7 @@ static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
if (dev->endpoint[EP2I(ep)].bufpq_size >
dev->endpoint[EP2I(ep)].bufpq_target_size) {
free(data);
return;
return -1;
}
dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
}
@ -477,6 +477,7 @@ static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
bufp->free_on_destroy = free_on_destroy;
QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
dev->endpoint[EP2I(ep)].bufpq_size++;
return 0;
}
static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
@ -2082,13 +2083,17 @@ static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
status = usb_redir_success;
free_on_destroy = NULL;
for (i = 0; i < data_len; i += len) {
int r;
if (len >= (data_len - i)) {
len = data_len - i;
status = buffered_bulk_packet->status;
free_on_destroy = data;
}
/* bufp_alloc also adds the packet to the ep queue */
bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);
r = bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);
if (r) {
break;
}
}
if (dev->endpoint[EP2I(ep)].pending_async_packet) {