NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash on OOM in virDomainSnapshotDefParse

Browse Source 
The virDomainSnapshotDefParse method assigned to def->ndisks
before allocating def->disks. Thus if an OOM occurred, the
cleanup code would access out of bounds.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2013-09-25 09:34:25 +01:00
parent 8feae8e136
commit 93ac954094
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/conf/snapshot_conf.c
View File

@ -303,9 +303,9 @@ virDomainSnapshotDefParse(xmlXPathContextPtr ctxt,
if ((n = virXPathNodeSet("./disks/*", ctxt, &nodes)) < 0) if ((n = virXPathNodeSet("./disks/*", ctxt, &nodes)) < 0)
goto cleanup; goto cleanup;
if (flags & VIR_DOMAIN_SNAPSHOT_PARSE_DISKS) { if (flags & VIR_DOMAIN_SNAPSHOT_PARSE_DISKS) {
def->ndisks = n; if (n && VIR_ALLOC_N(def->disks, n) < 0)
if (def->ndisks && VIR_ALLOC_N(def->disks, def->ndisks) < 0)
goto cleanup; goto cleanup;
def->ndisks = n;
for (i = 0; i < def->ndisks; i++) { for (i = 0; i < def->ndisks; i++) {
if (virDomainSnapshotDiskDefParseXML(nodes[i], &def->disks[i]) < 0) if (virDomainSnapshotDiskDefParseXML(nodes[i], &def->disks[i]) < 0)
goto cleanup; goto cleanup;