motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-17 15:12:07 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

usb-redirect: Avoid double free of data

Browse source 
If dropping packets, data is freed, the caller's loop should not continue.

Reported by ccc-analyzer.

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 1456301288-1592-1-git-send-email-famz@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Fam Zheng 2016-02-24 16:08:08 +08:00 • committed by Gerd Hoffmann
parent beded0ff7f
commit e8ce12d9ea
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
hw/usb/redirect.c
View file

@ -447,7 +447,7 @@ static USBPacket *usbredir_find_packet_by_id(USBRedirDevice *dev,
return p; return p;
} }
static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len, static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
uint8_t status, uint8_t ep, void *free_on_destroy) uint8_t status, uint8_t ep, void *free_on_destroy)
{ {
struct buf_packet *bufp; struct buf_packet *bufp;
@ -464,7 +464,7 @@ static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
if (dev->endpoint[EP2I(ep)].bufpq_size > if (dev->endpoint[EP2I(ep)].bufpq_size >
dev->endpoint[EP2I(ep)].bufpq_target_size) { dev->endpoint[EP2I(ep)].bufpq_target_size) {
free(data); free(data);
return; return -1;
} }
dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0; dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;
} }
@ -477,6 +477,7 @@ static void bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
bufp->free_on_destroy = free_on_destroy; bufp->free_on_destroy = free_on_destroy;
QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next); QTAILQ_INSERT_TAIL(&dev->endpoint[EP2I(ep)].bufpq, bufp, next);
dev->endpoint[EP2I(ep)].bufpq_size++; dev->endpoint[EP2I(ep)].bufpq_size++;
return 0;
} }
static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp, static void bufp_free(USBRedirDevice *dev, struct buf_packet *bufp,
@ -2082,13 +2083,17 @@ static void usbredir_buffered_bulk_packet(void *priv, uint64_t id,
status = usb_redir_success; status = usb_redir_success;
free_on_destroy = NULL; free_on_destroy = NULL;
for (i = 0; i < data_len; i += len) { for (i = 0; i < data_len; i += len) {
int r;
if (len >= (data_len - i)) { if (len >= (data_len - i)) {
len = data_len - i; len = data_len - i;
status = buffered_bulk_packet->status; status = buffered_bulk_packet->status;
free_on_destroy = data; free_on_destroy = data;
} }
/* bufp_alloc also adds the packet to the ep queue */ /* bufp_alloc also adds the packet to the ep queue */
bufp_alloc(dev, data + i, len, status, ep, free_on_destroy); r = bufp_alloc(dev, data + i, len, status, ep, free_on_destroy);
if (r) {
break;
}
} }
if (dev->endpoint[EP2I(ep)].pending_async_packet) { if (dev->endpoint[EP2I(ep)].pending_async_packet) {