Commit fe68e4b47b for qemu.org

commit fe68e4b47bf5a3ff016a8c2b580e05c93df05752
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Jul 19 15:32:16 2026 +0400

    replay: fix use of uninitialized pointer on error

    When bdrv_snapshot_list() returns a negative error code, sn_tab is
    uninitialized. The loop does not execute (since i=0 < negative is
    false), but the code falls through to g_free(sn_tab) which frees
    an uninitialized pointer.

    Fixes: f6baed3d1485 ("replay: implement replay-seek command")
    Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Message-ID: <20260719113216.1177594-1-marcandre.lureau@redhat.com>
    Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

diff --git a/replay/replay-debugging.c b/replay/replay-debugging.c
index 1105364002..7b904a1416 100644
--- a/replay/replay-debugging.c
+++ b/replay/replay-debugging.c
@@ -139,9 +139,8 @@ static char *replay_find_nearest_snapshot(int64_t icount,
                                           int64_t *snapshot_icount)
 {
     BlockDriverState *bs;
-    QEMUSnapshotInfo *sn_tab;
+    g_autofree QEMUSnapshotInfo *sn_tab = NULL;
     QEMUSnapshotInfo *nearest = NULL;
-    char *ret = NULL;
     int rv;
     int nb_sns, i;

@@ -149,15 +148,19 @@ static char *replay_find_nearest_snapshot(int64_t icount,

     bs = bdrv_all_find_vmstate_bs(NULL, false, NULL, NULL);
     if (!bs) {
-        goto fail;
+        return NULL;
     }

     nb_sns = bdrv_snapshot_list(bs, &sn_tab);
+    if (nb_sns < 0) {
+        return NULL;
+    }

     for (i = 0; i < nb_sns; i++) {
         rv = bdrv_all_has_snapshot(sn_tab[i].name, false, NULL, NULL);
-        if (rv < 0)
-            goto fail;
+        if (rv < 0) {
+            return NULL;
+        }
         if (rv == 1) {
             if (sn_tab[i].icount != -1ULL
                 && sn_tab[i].icount <= icount
@@ -166,14 +169,12 @@ static char *replay_find_nearest_snapshot(int64_t icount,
             }
         }
     }
-    if (nearest) {
-        ret = g_strdup(nearest->name);
-        *snapshot_icount = nearest->icount;
+    if (!nearest) {
+        return NULL;
     }
-    g_free(sn_tab);

-fail:
-    return ret;
+    *snapshot_icount = nearest->icount;
+    return g_strdup(nearest->name);
 }

 static void replay_seek(int64_t icount, QEMUTimerCB callback, Error **errp)