On 3/16/21 2:44 PM, [email protected] wrote: > From: Marc-André Lureau <[email protected]> > > g_hash_table_add always retains ownership of the pointer passed in as > the key. Its return status merely indicates whether the added entry was > new, or replaced an existing entry. Thus key must never be freed after > this method returns. > > Spotted by ASAN: > > ==2407186==ERROR: AddressSanitizer: heap-use-after-free on address > 0x6020003ac4f0 at pc 0x7ffff766659c bp 0x7fffffffd1d0 sp 0x7fffffffc980 > READ of size 1 at 0x6020003ac4f0 thread T0 > #0 0x7ffff766659b (/lib64/libasan.so.6+0x8a59b) > #1 0x7ffff6bfa843 in g_str_equal ../glib/ghash.c:2303 > #2 0x7ffff6bf8167 in g_hash_table_lookup_node ../glib/ghash.c:493 > #3 0x7ffff6bf9b78 in g_hash_table_insert_internal ../glib/ghash.c:1598 > #4 0x7ffff6bf9c32 in g_hash_table_add ../glib/ghash.c:1689 > #5 0x5555596caad4 in module_load_one ../util/module.c:233 > #6 0x5555596ca949 in module_load_one ../util/module.c:225 > #7 0x5555596ca949 in module_load_one ../util/module.c:225 > #8 0x5555596cbdf4 in module_load_qom_all ../util/module.c:349 > > Typical C bug... > > Fixes: 90629122d2e ("module: use g_hash_table_add()") > Cc: [email protected] > Signed-off-by: Marc-André Lureau <[email protected]> > Reviewed-by: Daniel P. Berrangé <[email protected]> > --- > util/module.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-)
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
