replay: fix use of uninitialized pointer on error
When bdrv_snapshot_list() returns a negative error code, sn_tab is uninitialized. The loop does not execute (since i=0 < negative is false), but the code falls through to g_free(sn_tab) which frees an uninitialized pointer. Fixes: f6baed3d1485 ("replay: implement replay-seek command") Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Message-ID: <20260719113216.1177594-1-marcandre.lureau@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Marc-André Lureau committed
Jul 19, 2026 at 15:32 UTC
fe68e4b47bf5a3ff016a8c2b580e05c93df05752
1 file changed
+12
-11
replay/replay-debugging.c
+12
-11
@@ -139,9 +139,8 @@ static char *replay_find_nearest_snapshot(int64_t icount,
139
int64_t *snapshot_icount)
140
{
141
BlockDriverState *bs;
142
- QEMUSnapshotInfo *sn_tab;
142
+ g_autofree QEMUSnapshotInfo *sn_tab = NULL;
143
QEMUSnapshotInfo *nearest = NULL;
144
- char *ret = NULL;
144
int rv;
145
int nb_sns, i;
146
@@ -149,15 +148,19 @@ static char *replay_find_nearest_snapshot(int64_t icount,
148
149
bs = bdrv_all_find_vmstate_bs(NULL, false, NULL, NULL);
150
if (!bs) {
152
- goto fail;
151
+ return NULL;
152
}
153
154
nb_sns = bdrv_snapshot_list(bs, &sn_tab);
155
+ if (nb_sns < 0) {
156
+ return NULL;
157
+ }
158
159
for (i = 0; i < nb_sns; i++) {
160
rv = bdrv_all_has_snapshot(sn_tab[i].name, false, NULL, NULL);
159
- if (rv < 0)
160
- goto fail;
161
+ if (rv < 0) {
162
+ return NULL;
163
+ }
164
if (rv == 1) {
165
if (sn_tab[i].icount != -1ULL
166
&& sn_tab[i].icount <= icount
@@ -166,14 +169,12 @@ static char *replay_find_nearest_snapshot(int64_t icount,
169
}
170
}
171
}
169
- if (nearest) {
170
- ret = g_strdup(nearest->name);
171
- *snapshot_icount = nearest->icount;
172
+ if (!nearest) {
173
+ return NULL;
174
}
173
- g_free(sn_tab);
175
175
-fail:
176
- return ret;
176
+ *snapshot_icount = nearest->icount;
177
+ return g_strdup(nearest->name);
178
}
179
180
static void replay_seek(int64_t icount, QEMUTimerCB callback, Error **errp)