On Sat, Jan 09, 2010 at 09:26:11PM +0100, Matthias Bolte wrote:
> qemudWaitForMonitor calls qemudReadLogOutput with qemudFindCharDevicePTYs
> as callback. qemudFindCharDevicePTYs calls qemudExtractTTYPath to assign
> a string to chr->data.file.path. Afterwards qemudWaitForMonitor may call
> qemudFindCharDevicePTYsMonitor that overwrites chr->data.file.path without
> freeing the old value. This results in leaking the memory allocated by
> qemudExtractTTYPath.
>
> Report an OOM error if the strdup in qemudFindCharDevicePTYsMonitor fails.
> ---
> src/qemu/qemu_driver.c | 6 ++++++
> 1 files changed, 6 insertions(+), 0 deletions(-)
>
> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
> index daa6f94..8817565 100644
> --- a/src/qemu/qemu_driver.c
> +++ b/src/qemu/qemu_driver.c
> @@ -1433,7 +1433,13 @@ qemudFindCharDevicePTYsMonitor(virConnectPtr conn,
> return -1; \
> } \
> \
> + VIR_FREE(chr->data.file.path); \
> chr->data.file.path = strdup(path); \
> + \
> + if (chr->data.file.path == NULL) { \
> + virReportOOMError(conn); \
> + return -1; \
> + } \
> } \
> }
>
> --
ACK
Daniel
--
|: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :|
|: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|
--
Libvir-list mailing list
Libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list