[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] xeniface: fix double-free of Path in IoctlStoreAddWatch fail8 path
- To: David ambu <david.preetham@xxxxxxxxxx>, "win-pv-devel@xxxxxxxxxxxxxxxxxxxx" <win-pv-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Owen Smith <owen.smith@xxxxxxxxxx>
- Date: Wed, 14 Oct 2026 06:37:20 +0000
- Accept-language: en-GB, en-US
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3rpFk7hRBckyxrGeUQCyZSPfuG7kwha7opwtqDdxkno=; b=O8y8za4NLGA1msbI/N9UBMOD74y14qkVobnhsPnWLlHkQk1j51l9BeUTmLVpvBHEqNOgvMz52lPabgh1gTrqrWHqdyAK0YFAY0BOcE/QDEzfqltV4XVtU1wPKb1bQSmjHgTMmo3YmdLehAIbZ8buWTILc3W/qTgQm/PLRAS9kR8ZaHZT2vLwkphhvCh4P+T3h4Ncf6vAV2QviEU+VCGohHIh7TGsJIIzkiUXUIT4AdqrBsT2ElLpzorrtYFdk+On9ehko2rJWN3VvP2rd8xQ8fdmVrakRAesggJlhkBQFfWJtkcF7iX3/LZPXnhXuiAswvS9ZK4KOCd+zzej4R2IJA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=NDQyU6UfdLO1k/b8BTAAPdn0dMxtyTj6bEf/G1wsvJK7J8E6k8q0ycFDXoqZgF+M62BIvJ3PbtW6c+2/gxGO+hgLvm36Rc7Ag4YFFkqOxEXT4VsgAJYA1kBk7QWanhlM1fd3CXFsYc7jYN+FMqX1kF04qkakp8/6e8dVONwVWcFlXouC0G0d9tC478BoXfjBHIWtZ9+m9ji2BR2F98TsOOqWv9MuZ/6Kigxa1qAbT0oA52R1gO9mLC3Og0H+thow251i3D91o0IXAZov6WQKgOP3YYhSU1Kh1wyBtO445WFcMsF8ROdQ19yYBaqG8K7XZGn55R4Hr/WMGy/D25IMkQ==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck"
- Authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Delivery-date: Wed, 14 Oct 2026 06:37:31 +0000
- List-id: Developer list for the Windows PV Drivers subproject <win-pv-devel.lists.xenproject.org>
- Msip_labels:
- Thread-index: AQHdWykqiaxC3KUfPEGFbUwAmUTmDLb8lmdv
- Thread-topic: [PATCH] xeniface: fix double-free of Path in IoctlStoreAddWatch fail8 path
Reviewed-by: Owen Smith <owen.smith@xxxxxxxxxx>
________________________________________
From: win-pv-devel <win-pv-devel-bounces@xxxxxxxxxxxxxxxxxxxx> on behalf of
david ambu <david.preetham@xxxxxxxxxx>
Sent: 13 October 2026 4:39 PM
To: win-pv-devel@xxxxxxxxxxxxxxxxxxxx
Cc: David ambu
Subject: [PATCH] xeniface: fix double-free of Path in IoctlStoreAddWatch fail8
path
Context->Path and Path point to the same buffer. On WatchAdd failure,
fail8 freed Context->Path then fell through to fail4 which freed Path
again, causing a double-free and heap corruption.
Remove the free from fail8; fail4 already handles it via the Path
variable.
Signed-off-by: david ambu <david.preetham@xxxxxxxxxx>
Assisted by Claude Sonnet 4.6
---
src/xeniface/ioctl_store.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/src/xeniface/ioctl_store.c b/src/xeniface/ioctl_store.c
index e0072f0..c3beca2 100644
--- a/src/xeniface/ioctl_store.c
+++ b/src/xeniface/ioctl_store.c
@@ -602,8 +602,6 @@ IoctlStoreAddWatch(
return status;
fail8:
- __FreeCapturedBuffer(Context->Path);
-
Error("Fail8\n");
ThreadAlert(Context->Thread);
ThreadJoin(Context->Thread);
--
2.51.0.windows.1
|
