2010/1/11 Daniel P. Berrange <berrange@xxxxxxxxxx>:
> On Sat, Jan 09, 2010 at 09:26:11PM +0100, Matthias Bolte wrote:
>> qemudWaitForMonitor calls qemudReadLogOutput with qemudFindCharDevicePTYs
>> as callback. qemudFindCharDevicePTYs calls qemudExtractTTYPath to assign
>> a string to chr->data.file.path. Afterwards qemudWaitForMonitor may call
>> qemudFindCharDevicePTYsMonitor that overwrites chr->data.file.path without
>> freeing the old value. This results in leaking the memory allocated by
>> qemudExtractTTYPath.
>>
>> Report an OOM error if the strdup in qemudFindCharDevicePTYsMonitor fails.
>> ---
>> src/qemu/qemu_driver.c | 6 ++++++
>> 1 files changed, 6 insertions(+), 0 deletions(-)
>>
>> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
>> index daa6f94..8817565 100644
>> --- a/src/qemu/qemu_driver.c
>> +++ b/src/qemu/qemu_driver.c
>> @@ -1433,7 +1433,13 @@ qemudFindCharDevicePTYsMonitor(virConnectPtr conn,
>> return -1; \
>> } \
>> \
>> + VIR_FREE(chr->data.file.path); \
>> chr->data.file.path = strdup(path); \
>> + \
>> + if (chr->data.file.path == NULL) { \
>> + virReportOOMError(conn); \
>> + return -1; \
>> + } \
>> } \
>> }
>>
>> --
>
> ACK
>
> Daniel
Thanks, pushed.
Matthias
--
Libvir-list mailing list
Libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list