[Xen-changelog] [qemu-xen master] qdev: fix use-after-free regression from becdfa00cfa

[patchbot@xxxxxxx]

commit 2209401fa73e176ed093167b8f60aba797f25d49
Author:     Marc-André Lureau <marcandre.lureau@xxxxxxxxxx>
AuthorDate: Mon Nov 7 13:59:22 2016 +0400
Commit:     Paolo Bonzini <pbonzini@xxxxxxxxxx>
CommitDate: Thu Nov 10 16:01:09 2016 +0100

    qdev: fix use-after-free regression from becdfa00cfa
    
    Spotted by Coverity, CID 1365383.
    
    Signed-off-by: Marc-André Lureau <marcandre.lureau@xxxxxxxxxx>
    Message-Id: <20161107095922.31676-1-marcandre.lureau@xxxxxxxxxx>
    Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
---
 hw/core/qdev-properties-system.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index c35f0f5..1b7ea50 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -200,18 +200,14 @@ static void set_chr(Object *obj, Visitor *v, const char 
*name, void *opaque,
     }
 
     s = qemu_chr_find(str);
-    g_free(str);
     if (s == NULL) {
         error_setg(errp, "Property '%s.%s' can't find value '%s'",
                    object_get_typename(obj), prop->name, str);
-        return;
-    }
-
-    if (!qemu_chr_fe_init(be, s, errp)) {
+    } else if (!qemu_chr_fe_init(be, s, errp)) {
         error_prepend(errp, "Property '%s.%s' can't take value '%s': ",
                       object_get_typename(obj), prop->name, str);
-        return;
     }
+    g_free(str);
 }
 
 static void release_chr(Object *obj, const char *name, void *opaque)
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog