xen-block: remove NULL pointer dereference
If params is NULL, xen_block_drive_create calls xen_block_drive_destroy with drive == NULL. Reported-by: Siteshwar Vashisht <svashisht@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini committed
Mar 2, 2026 at 13:37 UTC
ef586b5ad5f1d1a4f64a6ba7880dfcb1844c182a
1 file changed
+16
-19
hw/block/xen-block.c
+16
-19
@@ -883,32 +883,29 @@ static XenBlockDrive *xen_block_drive_create(const char *id,
883
QDict *driver_layer;
884
struct stat st;
885
int rc;
886
+ char **v;
887
887
- if (params) {
888
- char **v = g_strsplit(params, ":", 2);
888
+ if (!params) {
889
+ error_setg(errp, "no params");
890
+ return NULL;
891
+ }
892
890
- if (v[1] == NULL) {
891
- filename = g_strdup(v[0]);
893
+ v = g_strsplit(params, ":", 2);
894
+ if (v[1] == NULL) {
895
+ filename = g_strdup(v[0]);
896
+ driver = g_strdup("raw");
897
+ } else {
898
+ if (strcmp(v[0], "aio") == 0) {
899
driver = g_strdup("raw");
900
+ } else if (strcmp(v[0], "vhd") == 0) {
901
+ driver = g_strdup("vpc");
902
} else {
894
- if (strcmp(v[0], "aio") == 0) {
895
- driver = g_strdup("raw");
896
- } else if (strcmp(v[0], "vhd") == 0) {
897
- driver = g_strdup("vpc");
898
- } else {
899
- driver = g_strdup(v[0]);
900
- }
901
- filename = g_strdup(v[1]);
903
+ driver = g_strdup(v[0]);
904
}
903
-
904
- g_strfreev(v);
905
- } else {
906
- error_setg(errp, "no params");
907
- goto done;
905
+ filename = g_strdup(v[1]);
906
}
907
910
- assert(filename);
911
- assert(driver);
908
+ g_strfreev(v);
909
910
drive = g_new0(XenBlockDrive, 1);
911
drive->id = g_strdup(id);