[libvirt] [PATCH] qemu: Fix NULL pointer access in qemuProcessInitCpuAffinity()

Commit 2f2254c7f4e5 attempted to fix a memory leak by ensuring cpumapToSet is always a freshly allocated bitmap, but regrettably introduced a NULL pointer access while doing so, because it called virBitmapCopy() without allocating the destination bitmap first. Solve the issue by using virBitmapNewCopy() instead. Reported-by: John Ferlan <jferlan@redhat.com> Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/qemu/qemu_process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 42a6271411..50a76aa0ed 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -2498,7 +2498,7 @@ qemuProcessInitCpuAffinity(virDomainObjPtr vm) if (virNumaNodesetToCPUset(nodeset, &cpumapToSet) < 0) return -1; } else if (vm->def->cputune.emulatorpin) { - if (virBitmapCopy(cpumapToSet, vm->def->cputune.emulatorpin) < 0) + if (!(cpumapToSet = virBitmapNewCopy(vm->def->cputune.emulatorpin))) return -1; } else { if (qemuProcessGetAllCpuAffinity(&cpumapToSet) < 0) -- 2.21.0

On Thu, Jun 06, 2019 at 03:44:33PM +0200, Andrea Bolognani wrote:
Commit 2f2254c7f4e5 attempted to fix a memory leak by ensuring cpumapToSet is always a freshly allocated bitmap, but regrettably introduced a NULL pointer access while doing so, because it called virBitmapCopy() without allocating the destination bitmap first.
Solve the issue by using virBitmapNewCopy() instead.
Reported-by: John Ferlan <jferlan@redhat.com> Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- Reviewed-by: Erik Skultety <eskultet@redhat.com>

On 6/6/19 9:44 AM, Andrea Bolognani wrote:
Commit 2f2254c7f4e5 attempted to fix a memory leak by ensuring cpumapToSet is always a freshly allocated bitmap, but regrettably introduced a NULL pointer access while doing so, because it called virBitmapCopy() without allocating the destination bitmap first.
Solve the issue by using virBitmapNewCopy() instead.
Reported-by: John Ferlan <jferlan@redhat.com> Signed-off-by: Andrea Bolognani <abologna@redhat.com> --- src/qemu/qemu_process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: John Ferlan <jferlan@redhat.com> Coverity is happy too ;-) John
participants (3)
-
Andrea Bolognani
-
Erik Skultety
-
John Ferlan