NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash on OOM in xenParseSxpr

Browse Source 
The xenParseSxpr method sets def->nconsoles to 1 before allocating
the def->consoles array. If the allocation fails due to OOM the
cleanup code will thus crash accessing out of bounds.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2013-09-25 09:30:20 +01:00
parent b80fff1444
commit d508f70df0
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/xenxs/xen_sxpr.c
View File

@ -1439,9 +1439,9 @@ xenParseSxpr(const struct sexpr *root,
def->parallels[def->nparallels++] = chr; def->parallels[def->nparallels++] = chr;
} }
} else if (def->id != 0) { } else if (def->id != 0) {
def->nconsoles = 1;
if (VIR_ALLOC_N(def->consoles, 1) < 0) if (VIR_ALLOC_N(def->consoles, 1) < 0)
goto error; goto error;
def->nconsoles = 1;
/* Fake a paravirt console, since that's not in the sexpr */ /* Fake a paravirt console, since that's not in the sexpr */
if (!(def->consoles[0] = xenParseSxprChar("pty", tty))) if (!(def->consoles[0] = xenParseSxprChar("pty", tty)))
goto error; goto error;