virdomainjob: preserveJob: memdup the cb structure instead of copying it

In case of variable 'oldjob' (job structure) in
qemuProcessReconnect() the cb pointer was just copied from the
existing job structure in virDomainObjPreserveJob(). This caused
the job and oldjob sharing the same pointer, which was later
freed at the end of the qemuProcessReconnect() function by
automatic call to virDomainObjClearJob(). This caused an invalid
read in and subsequent daemon crash as the job structure was
trying to read cb which had been already freed.

This patch changes the copying to g_memdup that allocates
different pointer, which can be later safely freed.

Signed-off-by: Kristina Hanicova <khanicov@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>

diff --git a/src/conf/virdomainjob.c b/src/conf/virdomainjob.c
index aca801af381c213296345dbc9afe686b4d695fb0..0c67e84ef19788d136d6fd81fa42bf29002f86c1 100644 (file)
--- a/src/conf/virdomainjob.c
+++ b/src/conf/virdomainjob.c
@@ -210,7 +210,7 @@ virDomainObjPreserveJob(virDomainJobObj *currJob,
     if (currJob->cb && currJob->cb->allocJobPrivate &&
         !(currJob->privateData = currJob->cb->allocJobPrivate()))
         return -1;
-    job->cb = currJob->cb;
+    job->cb = g_memdup(currJob->cb, sizeof(*currJob->cb));
 
     virDomainObjResetJob(currJob);
     virDomainObjResetAsyncJob(currJob);