From: Denis Rastyogin <ger...@altlinux.org> This error was discovered by fuzzing qemu-img.
A double-free issue in the VMDK driver occurs when handling snapshots. The memory allocated for extent structures is freed twice: first in vmdk_close (block/vmdk.c) and then in vmdk_add_extent (block/vmdk.c). The fix ensures the s->extents pointer is set to NULL after freeing, preventing double-free. Closes: https://gitlab.com/qemu-project/qemu/-/issues/2853 Signed-off-by: Denis Rastyogin <ger...@altlinux.org> --- block/vmdk.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/vmdk.c b/block/vmdk.c index 2adec49912..d6baa54602 100644 --- a/block/vmdk.c +++ b/block/vmdk.c @@ -285,6 +285,7 @@ static void vmdk_free_extents(BlockDriverState *bs) bdrv_graph_wrunlock(); g_free(s->extents); + s->extents = NULL; } static void vmdk_free_last_extent(BlockDriverState *bs) -- 2.42.2
