Bug 885644
| Summary: | Memory leak and use after free in qxl_render_update_area_unlocked() | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Markus Armbruster <armbru> |
| Component: | qemu-kvm | Assignee: | Gerd Hoffmann <kraxel> |
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.4 | CC: | acathrow, areis, bsarathy, dyasny, juzhang, michen, mkenneth, mrezanin, tlavigne, virt-maint |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | qemu-kvm-0.12.1.2-2.351.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-02-21 07:45:23 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux. Fixed upstream in commit 2f464b5a. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0527.html |
Description of problem: Coverity points out 120 if (qxl->guest_primary.qxl_stride > 0) { 121 qemu_free_displaysurface(vga->ds); (4) Event alloc_fn: Storage is returned from allocation function "qemu_create_displaysurface_from(int, int, int, int, uint8_t *)". [details] (5) Event leaked_storage: Ignoring storage allocated by "qemu_create_displaysurface_from(qxl->guest_primary.surface.width, qxl->guest_primary.surface.height, qxl->guest_primary.bits_pp, qxl->guest_primary.abs_stride, qxl->guest_primary.data)" leaks it. 122 qemu_create_displaysurface_from(qxl->guest_primary.surface.width, 123 qxl->guest_primary.surface.height, 124 qxl->guest_primary.bits_pp, 125 qxl->guest_primary.abs_stride, 126 qxl->guest_primary.data); 127 } else { 128 qemu_resize_displaysurface(vga->ds, 129 qxl->guest_primary.surface.width, 130 qxl->guest_primary.surface.height); 131 } 132 dpy_resize(vga->ds); Not only does this leak the memory allocated by qemu_create_displaysurface_from() in line 122, it also keeps vga->ds pointing to the memory freed by qemu_free_displaysurface() in line 121, then passes it to dpy_resize() in line 132. Version-Release number of selected component (if applicable): qemu-kvm-0.12.1.2-2.340.el6 How reproducible: Not tried; bug found by static analysis Steps to Reproduce: Non known Actual results: Memory leak, and use-after-free with unknown impact. Expected results: No leak, no use after free.