@samitouri / QOSamiQemu / commits / f1b1db98cc

util/cutils: Fix heap corruption under Windows

Under Windows, QEMU would only sporadically start successfully. In the G_OS_WIN32 case, get_relocated_path() first determines a cursor to the end of the "result" string and then increases its size with g_string_set_size(). Since g_string_set_size() may reallocate, the cursor may become dangling. Windows may detect this and crash the QEMU process with the following message: HEAP: Free Heap block 000000000499B640 modified at 000000000499B684 after it was freed Furthermore, QEMU crashes spontaneously, even long after the guest has booted. For example, it presumably crashes due to the guest setting a new cursor icon which may be a result of the heap corruption. Fix this by determining the cursor on the resized string. Fixes: cf60ccc3306c ("cutils: Introduce bundle mechanism") Cc: qemu-stable@nongnu.org Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Message-id: 20260414114033.2360-1-shentey@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Bernhard Beschow committed Apr 14, 2026 at 13:40 UTC f1b1db98cc3b7212d7efffab516d38d0a913f432

1 file changed +2 -1

util/cutils.c

+2 -1

@@ -1165,9 +1165,10 @@ char *get_relocated_path(const char *dir)

1165

1166 PCWSTR wdir_skipped_root;

1167 if (PathCchSkipRoot(wdir, &wdir_skipped_root) == S_OK) {

1168 + char *cursor;

1169 size = wcsrtombs(NULL, &wdir_skipped_root, 0, &(mbstate_t){0});

1169 - char *cursor = result->str + result->len;

1170 g_string_set_size(result, result->len + size);

1171 + cursor = result->str + result->len - size;

1172 wcsrtombs(cursor, &wdir_skipped_root, size + 1, &(mbstate_t){0});

1173 } else {

1174 g_string_append(result, dir);