Commit id's 'c9a641f1e' and 'aa2cc721' added calls to virSocketAddrFormat but did not check for a NULL (error) return which could lead to bad output in the XML file. Need to check for NULL return and cause failure. Signed-off-by: John Ferlan <jferlan@xxxxxxxxxx> --- src/conf/domain_conf.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index b53cb8d..ef517b4 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -17254,7 +17254,7 @@ virDomainFSDefFormat(virBufferPtr buf, return 0; } -static void +static int virDomainNetIpsFormat(virBufferPtr buf, virDomainNetIpDefPtr *ips, size_t nips) { size_t i; @@ -17264,6 +17264,9 @@ virDomainNetIpsFormat(virBufferPtr buf, virDomainNetIpDefPtr *ips, size_t nips) virSocketAddrPtr address = &ips[i]->address; char *ipStr = virSocketAddrFormat(address); const char *familyStr = NULL; + + if (!ipStr) + return -1; if (VIR_SOCKET_ADDR_IS_FAMILY(address, AF_INET6)) familyStr = "ipv6"; else if (VIR_SOCKET_ADDR_IS_FAMILY(address, AF_INET)) @@ -17277,9 +17280,10 @@ virDomainNetIpsFormat(virBufferPtr buf, virDomainNetIpDefPtr *ips, size_t nips) virBufferAsprintf(buf, " prefix='%u'", ips[i]->prefix); virBufferAddLit(buf, "/>\n"); } + return 0; } -static void +static int virDomainNetRoutesFormat(virBufferPtr buf, virDomainNetRouteDefPtr *routes, size_t nroutes) @@ -17292,6 +17296,8 @@ virDomainNetRoutesFormat(virBufferPtr buf, char *via = virSocketAddrFormat(&route->via); char *to = NULL; + if (!via) + return -1; if (VIR_SOCKET_ADDR_IS_FAMILY(&route->via, AF_INET6)) familyStr = "ipv6"; else if (VIR_SOCKET_ADDR_IS_FAMILY(&route->via, AF_INET)) @@ -17301,6 +17307,8 @@ virDomainNetRoutesFormat(virBufferPtr buf, if (VIR_SOCKET_ADDR_VALID(&route->to)) { to = virSocketAddrFormat(&route->to); + if (!to) + return -1; virBufferAsprintf(buf, " address='%s'", to); VIR_FREE(to); } @@ -17310,6 +17318,7 @@ virDomainNetRoutesFormat(virBufferPtr buf, virBufferAddLit(buf, "/>\n"); } + return 0; } static int @@ -17465,10 +17474,12 @@ virDomainHostdevDefFormatCaps(virBufferPtr buf, virBufferAddLit(buf, "</source>\n"); if (def->source.caps.type == VIR_DOMAIN_HOSTDEV_CAPS_TYPE_NET) { - virDomainNetIpsFormat(buf, def->source.caps.u.net.ips, - def->source.caps.u.net.nips); - virDomainNetRoutesFormat(buf, def->source.caps.u.net.routes, - def->source.caps.u.net.nroutes); + if (virDomainNetIpsFormat(buf, def->source.caps.u.net.ips, + def->source.caps.u.net.nips) < 0) + return -1; + if (virDomainNetRoutesFormat(buf, def->source.caps.u.net.routes, + def->source.caps.u.net.nroutes) < 0) + return -1; } return 0; @@ -17857,8 +17868,10 @@ virDomainNetDefFormat(virBufferPtr buf, return -1; } - virDomainNetIpsFormat(buf, def->ips, def->nips); - virDomainNetRoutesFormat(buf, def->routes, def->nroutes); + if (virDomainNetIpsFormat(buf, def->ips, def->nips) < 0) + return -1; + if (virDomainNetRoutesFormat(buf, def->routes, def->nroutes) < 0) + return -1; virBufferEscapeString(buf, "<script path='%s'/>\n", def->script); -- 2.1.0 -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list