If a storage file would be backed with a NBD device without path
(nbd://localhost) libvirt would crash when parsing the backing path for
the disk as the URI structure's path element is NULL in such case but
the NBD parser would access it shamelessly.
---
src/util/virstoragefile.c | 3 ++-
tests/virstoragetest.c | 14 ++++++++++++++
2 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c
index 8568ebb..8d3d1f5 100644
--- a/src/util/virstoragefile.c
+++ b/src/util/virstoragefile.c
@@ -2156,7 +2156,8 @@ virStorageSourceParseBackingURI(virStorageSourcePtr src,
/* XXX We currently don't support auth, so don't bother parsing it */
/* possibly skip the leading slash */
- if (VIR_STRDUP(src->path,
+ if (uri->path &&
+ VIR_STRDUP(src->path,
*uri->path == '/' ? uri->path + 1 : uri->path) < 0)
goto cleanup;
diff --git a/tests/virstoragetest.c b/tests/virstoragetest.c
index d7597d7..38ce09e 100644
--- a/tests/virstoragetest.c
+++ b/tests/virstoragetest.c
@@ -871,6 +871,20 @@ mymain(void)
(&qcow2, &nbd2), EXP_PASS,
(&qcow2, &nbd2), ALLOW_PROBE | EXP_PASS);
+ /* Rewrite qcow2 to use an nbd: protocol without path as backend */
+ virCommandFree(cmd);
+ cmd = virCommandNewArgList(qemuimg, "rebase", "-u", "-f", "qcow2",
+ "-F", "raw", "-b", "nbd://example.org",
+ "qcow2", NULL);
+ if (virCommandRun(cmd, NULL) < 0)
+ ret = -1;
+ qcow2.expBackingStoreRaw = "nbd://example.org";
+
+ nbd2.path = NULL;
+ TEST_CHAIN(absqcow2, VIR_STORAGE_FILE_QCOW2,
+ (&qcow2, &nbd2), EXP_PASS,
+ (&qcow2, &nbd2), ALLOW_PROBE | EXP_PASS);
+
/* qed file */
testFileData qed = {
.expBackingStoreRaw = absraw,
--
2.2.2
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list