commit a2b83a5165c567bb81fe4303d97a3cca5ccc8a15
author Thomas Huth <thuth@redhat.com> Tue Jul 24 13:52:04 2018 +0200
committer Kevin Wolf <kwolf@redhat.com> Mon Nov 05 15:09:54 2018 +0100
tree 7df8da1cc0cbb35fc82d464fc60628c554cbb733
parent b2f7a038bb4c4fc5ce6b8486e8513dfd97665e2a

block/vvfat: Fix crash when reporting error about too many files in directory

When using the vvfat driver with a directory that contains too many files,
QEMU currently crashes. This can be triggered like this for example:

 mkdir /tmp/vvfattest
 cd /tmp/vvfattest
 for ((x=0;x<=513;x++)); do mkdir $x; done
 qemu-system-x86_64 -drive \
   file.driver=vvfat,file.dir=.,read-only=on,media=cdrom

Seems like read_directory() is changing the mapping->path variable. Make
sure we use the right pointer instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block/vvfat.c

diff --git a/block/vvfat.c b/block/vvfat.c
index fc41841..f2e7d50 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -973,10 +973,10 @@
         mapping = array_get(&(s->mapping), i);
 
         if (mapping->mode & MODE_DIRECTORY) {
+            char *path = mapping->path;
             mapping->begin = cluster;
             if(read_directory(s, i)) {
-                error_setg(errp, "Could not read directory %s",
-                           mapping->path);
+                error_setg(errp, "Could not read directory %s", path);
                 return -1;
             }
             mapping = array_get(&(s->mapping), i);