From 157aad004c24003bfa33aca7bcbb5bd109d4fdff Mon Sep 17 00:00:00 2001 From: guping Date: Thu, 13 Nov 2025 01:24:53 +0000 Subject: [PATCH] qemu-img: Fix amend option parse error handling cherry-pick from f00bcc833790c72c08bc5eed97845fdaa7542507 qemu_opts_del(opts) dereferences opts->list, which is the old amend_opts pointer that can be dangling after executing qemu_opts_append(amend_opts, bs->drv->create_opts) and cause use-after-free. Fix the potential use-after-free by moving the qemu_opts_del() call before the qemu_opts_append() call. Signed-off-by: Akihiko Odaki Message-ID: <20251023-iotests-v1-1-fab143ca4c2f@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf Signed-off-by: guping --- qemu-img.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/qemu-img.c b/qemu-img.c index 87340a73c3..4c668f1316 100644 --- a/qemu-img.c +++ b/qemu-img.c @@ -4403,9 +4403,9 @@ static int img_amend(int argc, char **argv) amend_opts = qemu_opts_append(amend_opts, bs->drv->amend_opts); opts = qemu_opts_create(amend_opts, NULL, 0, &error_abort); if (!qemu_opts_do_parse(opts, options, NULL, &err)) { + qemu_opts_del(opts); /* Try to parse options using the create options */ amend_opts = qemu_opts_append(amend_opts, bs->drv->create_opts); - qemu_opts_del(opts); opts = qemu_opts_create(amend_opts, NULL, 0, &error_abort); if (qemu_opts_do_parse(opts, options, NULL, NULL)) { error_append_hint(&err, -- Gitee