[Qemu-devel] [PATCH] qdev: fix use-after-free regression from becdfa00cfa

* [Qemu-devel] [PATCH] qdev: fix use-after-free regression from becdfa00cfa
@ 2016-11-07  9:59 Marc-André Lureau
  0 siblings, 0 replies; only message in thread
From: Marc-André Lureau @ 2016-11-07  9:59 UTC (permalink / raw)
  To: qemu-devel; +Cc: pbonzini, Marc-André Lureau

Spotted by Coverity, CID 1365383.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/core/qdev-properties-system.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index c35f0f5..1b7ea50 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -200,18 +200,14 @@ static void set_chr(Object *obj, Visitor *v, const char *name, void *opaque,
     }
 
     s = qemu_chr_find(str);
-    g_free(str);
     if (s == NULL) {
         error_setg(errp, "Property '%s.%s' can't find value '%s'",
                    object_get_typename(obj), prop->name, str);
-        return;
-    }
-
-    if (!qemu_chr_fe_init(be, s, errp)) {
+    } else if (!qemu_chr_fe_init(be, s, errp)) {
         error_prepend(errp, "Property '%s.%s' can't take value '%s': ",
                       object_get_typename(obj), prop->name, str);
-        return;
     }
+    g_free(str);
 }
 
 static void release_chr(Object *obj, const char *name, void *opaque)
-- 
2.10.0

^ permalink raw reply related	[flat|nested] only message in thread