[libvirt PATCH] qemu: agent: clear stale pointer in qemuAgentGetDisks
From: Ján Tomko <jtomko@redhat.com> CVE-2026-77158 In case of hitting the cleanup label, the disks array was freed but the pointer was not cleared, leading to a possible double free. Fixes: 0cb2d9f05d00497a715352f6ea28cf8fb6921731 (v6.10.0-9-g0cb2d9f05d) Closes: https://gitlab.com/libvirt/libvirt/-/work_items/910 Reported-by: David Korczynski (Ada Logics) Found-by: Claude Signed-off-by: Ján Tomko <jtomko@redhat.com> --- src/hypervisor/qemu_agent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/hypervisor/qemu_agent.c b/src/hypervisor/qemu_agent.c index f5f50e3c92..431407b68e 100644 --- a/src/hypervisor/qemu_agent.c +++ b/src/hypervisor/qemu_agent.c @@ -2562,7 +2562,7 @@ int qemuAgentGetDisks(qemuAgent *agent, for (i = 0; i < ndata; i++) { qemuAgentDiskInfoFree((*disks)[i]); } - g_free(*disks); + g_clear_pointer(disks, g_free); return -1; } -- 2.55.0
On Fri, Aug 21, 2026 at 12:22:35 +0200, Ján Tomko via Devel wrote:
From: Ján Tomko <jtomko@redhat.com>
CVE-2026-77158
In case of hitting the cleanup label, the disks array was freed but the pointer was not cleared, leading to a possible double free.
Fixes: 0cb2d9f05d00497a715352f6ea28cf8fb6921731 (v6.10.0-9-g0cb2d9f05d) Closes: https://gitlab.com/libvirt/libvirt/-/work_items/910 Reported-by: David Korczynski (Ada Logics) Found-by: Claude Signed-off-by: Ján Tomko <jtomko@redhat.com> --- src/hypervisor/qemu_agent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/hypervisor/qemu_agent.c b/src/hypervisor/qemu_agent.c index f5f50e3c92..431407b68e 100644 --- a/src/hypervisor/qemu_agent.c +++ b/src/hypervisor/qemu_agent.c @@ -2562,7 +2562,7 @@ int qemuAgentGetDisks(qemuAgent *agent, for (i = 0; i < ndata; i++) { qemuAgentDiskInfoFree((*disks)[i]); } - g_free(*disks); + g_clear_pointer(disks, g_free); return -1; }
-- 2.55.0
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
participants (2)
-
Ján Tomko -
Peter Krempa