diff options
| author | Daniel Xu <dxu@dxuuu.xyz> | 2023-10-01 12:38:25 -0600 |
|---|---|---|
| committer | Konstantin Kostiuk <kkostiuk@redhat.com> | 2023-10-11 14:30:54 +0300 |
| commit | d6f67b83b81bf49b5c62e77143ed39c020e51830 (patch) | |
| tree | 371532c16e5e2e0dc2bcb7a6e6c04ccdacad2765 | |
| parent | 99bb31585cccd474b852deb29bd982e2ee542871 (diff) | |
qga: Fix memory leak when output stream is unused
If capture-output is requested but one of the channels goes unused (eg.
we attempt to capture stderr but the command never writes to stderr), we
can leak memory.
guest_exec_output_watch() is (from what I understand) unconditionally
called for both streams if output capture is requested. The first call
will always pass the `p->size == p->length` check b/c both values are
0. Then GUEST_EXEC_IO_SIZE bytes will be allocated for the stream.
But when we reap the exited process there's a `gei->err.length > 0`
check to actually free the buffer. Which does not get run if the command
doesn't write to the stream.
Fix by making free() unconditional.
Reviewed-by: Konstantin Kostiuk <kkostiuk@redhat.com>
Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com>
| -rw-r--r-- | qga/commands.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/qga/commands.c b/qga/commands.c index 09c683e263..ce172edd2d 100644 --- a/qga/commands.c +++ b/qga/commands.c @@ -206,15 +206,15 @@ GuestExecStatus *qmp_guest_exec_status(int64_t pid, Error **errp) #endif if (gei->out.length > 0) { ges->out_data = g_base64_encode(gei->out.data, gei->out.length); - g_free(gei->out.data); ges->has_out_truncated = gei->out.truncated; } + g_free(gei->out.data); if (gei->err.length > 0) { ges->err_data = g_base64_encode(gei->err.data, gei->err.length); - g_free(gei->err.data); ges->has_err_truncated = gei->err.truncated; } + g_free(gei->err.data); QTAILQ_REMOVE(&guest_exec_state.processes, gei, next); g_free(gei); |