Re: [PATCH] Add missing initialization for g_autofree variables

[Philippe Mathieu-Daudé]

On 3/12/21 1:03 PM, mrezanin@redhat.com wrote:
> From: Miroslav Rezanina <mrezanin@redhat.com>
> 
> When declaring g_autofree variable without inicialization, compiler
> will raise "may be used uninitialized in this function" warning due
> to automatic free handling. This usage can cause gfree using unknown.
> Such behavior can be dangerous and exploitable.

Will we be able to catch that earlier when building using
the Fedora/rawhide Docker image?

> 
> Add inicialization to NULL for these declaration to ensure uninitialized
> value is not used.
> 
> Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> ---
>  hw/remote/memory.c       | 2 +-
>  hw/remote/proxy.c        | 2 +-
>  hw/s390x/s390-pci-vfio.c | 4 ++--
>  3 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/remote/memory.c b/hw/remote/memory.c
> index 32085b1e05..bf0047a81b 100644
> --- a/hw/remote/memory.c
> +++ b/hw/remote/memory.c
> @@ -43,7 +43,7 @@ void remote_sysmem_reconfig(MPQemuMsg *msg, Error **errp)
>      remote_sysmem_reset();
>  
>      for (region = 0; region < msg->num_fds; region++) {
> -        g_autofree char *name;
> +        g_autofree char *name = NULL;
>          subregion = g_new(MemoryRegion, 1);
>          name = g_strdup_printf("remote-mem-%u", suffix++);

There is a reviewed patch for this one:
https://www.mail-archive.com/qemu-devel@nongnu.org/msg787631.html