Re: [Qemu-devel] [PATCH] block: prevent snapshot mode $TMPDIR symlink attack

[Stefan Hajnoczi]

On Mon, May 28, 2012 at 8:27 AM, Jim Meyering <address@hidden> wrote:
> diff --git a/block/vvfat.c b/block/vvfat.c
> index 2dc9d50..0fd3367 100644
> --- a/block/vvfat.c
> +++ b/block/vvfat.c
> @@ -2808,7 +2808,12 @@ static int enable_write_target(BDRVVVFATState *s)
>     array_init(&(s->commits), sizeof(commit_t));
>
>     s->qcow_filename = g_malloc(1024);
> -    get_tmp_filename(s->qcow_filename, 1024);
> +    ret = get_tmp_filename(s->qcow_filename, 1024);
> +    if (ret < 0) {
> +        g_free(s->qcow_filename);
> +        s->qcow_filename = NULL;
> +        return ret;
> +    }

It appears that s->used_clusters gets leaked in vvfat.  This can be
addressed in a separate patch since other codepaths also leak it.

Reviewed-by: Stefan Hajnoczi <address@hidden>