On Fri, Nov 04, 2011 at 17:08:06 +0800, Daniel Veillard wrote:
> On Fri, Nov 04, 2011 at 09:33:24AM +0100, Jiri Denemark wrote:
> > This causes libvirtd to crash when both <boot dev='...'/> and <boot
> > order='...'/> are used in one domain XML. Introduced by
> > 5fa3d775a9f8cdb3423373eb084219aaf778df11
> > ---
> > src/conf/domain_conf.c | 3 ++-
> > 1 files changed, 2 insertions(+), 1 deletions(-)
> >
> > diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
> > index 238edfd..a85f837 100644
> > --- a/src/conf/domain_conf.c
> > +++ b/src/conf/domain_conf.c
> > @@ -6430,7 +6430,8 @@ virDomainDefParseBootXML(xmlXPathContextPtr ctxt,
> > {
> > xmlNodePtr *nodes = NULL;
> > int i, n;
> > - char *bootstr, *useserial;
> > + char *bootstr;
> > + char *useserial = NULL;
> > int ret = -1;
> > unsigned long deviceBoot, serialPorts;
>
> Actually any input forcing us to go to cleanup before it's init
> would lead to the crash, I count 5 cases :-\
Right, I didn't check how many paths can lead to freeing this uninitialized
pointer since even one path is enough to be a real problem :-)
> thanks for spotting this, confirmation again what while cleaning
> Coverity large set one always reintroduce some errors back, good
> thing that one is trivial to fix :-) !
>
> ACK
Thanks and pushed.
Jirka
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list