[Qemu-commits] [qemu/qemu] f151f8: migration/ram.c: Fix use-after-free in multifd_rec...

[Peter Maydell]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: f151f8aca5cf5da24f6eb743a55a2233091ae532
      
https://github.com/qemu/qemu/commit/f151f8aca5cf5da24f6eb743a55a2233091ae532
  Author: Peter Maydell <address@hidden>
  Date:   2019-04-09 (Tue, 09 Apr 2019)

  Changed paths:
    M migration/ram.c

  Log Message:
  -----------
  migration/ram.c: Fix use-after-free in multifd_recv_unfill_packet()

Coverity points out (CID 1400442) that in this code:

    if (packet->pages_alloc > p->pages->allocated) {
        multifd_pages_clear(p->pages);
        multifd_pages_init(packet->pages_alloc);
    }

we free p->pages in multifd_pages_clear() but continue to
use it in the following code. We also leak memory, because
multifd_pages_init() returns the pointer to a new MultiFDPages_t
struct but we are ignoring its return value.

Fix both of these bugs by adding the missing assignment of
the newly created struct to p->pages.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Message-id: address@hidden
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>