[Libguestfs] [PATCH libldm] Fix crash while creating mapper for a volume which lacks all components.

Mykola Ivanets stenavin at gmail.com
Sun May 13 20:29:20 UTC 2018


How to reproduce:
1. Extract test images from test/data/ldm-data.tar.xz
2. losetup --show -f test/data/ldm-2003r2-simple-1.img
   Let's assume image file was associated with /dev/loop0
3. ldmtool -d /dev/loop0 create all

Result: One LDM volume which contains all required components on the
associated loop device will be mapped but application crashes on further
attempt to do the same for incomplete volumes with error "Error in
`ldmtool': free(): invalid pointer: 0x.......".

Reason: _dm_create_spanned and _dm_create_striped functions define
static local variable "static GString *name" which is at the same time a
function return value.  It is passed up to the call stack and is freed
in _ldm_vol_action function.  An attempt to free the same pointer will
be made if ldmtool successfully creates some volume first and then will
try to create incomplete volume.  Which will cause application crash.
---
 src/ldm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/ldm.c b/src/ldm.c
index 19a0663..372b0d7 100644
--- a/src/ldm.c
+++ b/src/ldm.c
@@ -2615,7 +2615,7 @@ _dm_create_part(const LDMPartitionPrivate * const part, uint32_t cookie,
 static GString *
 _dm_create_spanned(const LDMVolumePrivate * const vol, GError ** const err)
 {
-    static GString *name = NULL;
+    GString *name = NULL;
     guint i = 0;
     struct dm_target *targets = g_malloc(sizeof(*targets) * vol->parts->len);
 
@@ -2682,7 +2682,7 @@ out:
 static GString *
 _dm_create_striped(const LDMVolumePrivate * const vol, GError ** const err)
 {
-    static GString *name = NULL;
+    GString *name = NULL;
     struct dm_target target;
 
     target.start = 0;
-- 
2.17.0




More information about the Libguestfs mailing list