qemu-patch-raspberry4/target
Eduardo Habkost e38bf61247 i386: Fix arch_query_cpu_model_expansion() leak
Reported by Coverity:

Error: RESOURCE_LEAK (CWE-772): [#def439]
qemu-2.12.0/target/i386/cpu.c:3179: alloc_fn: Storage is returned from allocation function "qdict_new".
qemu-2.12.0/qobject/qdict.c:34:5: alloc_fn: Storage is returned from allocation function "g_malloc0".
qemu-2.12.0/qobject/qdict.c:34:5: var_assign: Assigning: "qdict" = "g_malloc0(4120UL)".
qemu-2.12.0/qobject/qdict.c:37:5: return_alloc: Returning allocated memory "qdict".
qemu-2.12.0/target/i386/cpu.c:3179: var_assign: Assigning: "props" = storage returned from "qdict_new()".
qemu-2.12.0/target/i386/cpu.c:3217: leaked_storage: Variable "props" going out of scope leaks the storage it points to.

This was introduced by commit b8097deb35 ("i386: Improve
query-cpu-model-expansion full mode").

The leak is only theoretical: if ret->model->props is set to
props, the qapi_free_CpuModelExpansionInfo() call will free props
too in case of errors.  The only way for this to not happen is if
we enter the default branch of the switch statement, which would
never happen because all CpuModelExpansionType values are being
handled.

It's still worth to change this to make the allocation logic
easier to follow and make the Coverity error go away.  To make
everything simpler, initialize ret->model and ret->model->props
earlier in the function.

While at it, remove redundant check for !prop because prop is
always initialized at the beginning of the function.

Fixes: b8097deb35
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <20180816183509.8231-1-ehabkost@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-08-23 18:46:25 +02:00
..
alpha tcg: Pass tb and index to tcg_gen_exit_tb separately 2018-06-01 15:15:27 -07:00
arm fix "Missing break in switch" coverity reports 2018-08-23 13:32:50 +02:00
cris tcg-next queue 2018-06-04 11:28:31 +01:00
hppa tcg-next queue 2018-06-04 11:28:31 +01:00
i386 i386: Fix arch_query_cpu_model_expansion() leak 2018-08-23 18:46:25 +02:00
lm32 tcg-next queue 2018-06-04 11:28:31 +01:00
m68k target/m68k: Merge disas_m68k_insn into m68k_tr_translate_insn 2018-06-11 12:43:42 +02:00
microblaze target-microblaze: Rework NOP/zero instruction handling 2018-06-15 09:05:00 +02:00
mips target/mips: Check ELPA flag only in some cases of MFHC0 and MTHC0 2018-08-16 19:18:45 +02:00
moxie tcg-next queue 2018-06-04 11:28:31 +01:00
nios2 tcg-next queue 2018-06-04 11:28:31 +01:00
openrisc target/openrisc: Fix writes to interrupt mask register 2018-07-03 22:40:33 +09:00
ppc target/ppc: fix build on ppc64 host 2018-07-07 12:12:27 +10:00
riscv RISC-V: Add trailing '\n' to qemu_log() calls 2018-06-08 13:15:33 +01:00
s390x s390x: Enable KVM huge page backing support 2018-08-20 14:18:49 +02:00
sh4 sh4: fix use_icount with linux-user 2018-08-20 00:11:06 +02:00
sparc SPARC64: add icount support 2018-06-17 11:13:06 +01:00
tilegx tcg-next queue 2018-06-04 11:28:31 +01:00
tricore tcg: Pass tb and index to tcg_gen_exit_tb separately 2018-06-01 15:15:27 -07:00
unicore32 tcg: Pass tb and index to tcg_gen_exit_tb separately 2018-06-01 15:15:27 -07:00
xtensa target/xtensa/cpu: Set owner of memory region in xtensa_cpu_initfn 2018-08-06 19:07:21 +01:00