[libvirt-glib 2/2] Fix potential crashes in error cases

[Christophe Fergeau <cfergeau@xxxxxxxxxx>]

fetch_list implementations in libvirt-gobject-connection.c and
libvirt-gobject-storage-pool.c can misbehave in error situations
or when the call is cancelled:
- when the call is cancelled, 'lst' will be NULL and 'n' non-0 so
we'll try to iterate over 'lst', which will cause a crash
- when list_func fails, 'lst' is likely to be uninitialized, which
will lead to invalid frees in the memory cleanup in the error: branch.
We can avoid this issue by making sure 'lst' is initialized to 0
when it's created.
---
 libvirt-gobject/libvirt-gobject-connection.c   | 10 ++++++----
 libvirt-gobject/libvirt-gobject-storage-pool.c | 10 ++++++----
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/libvirt-gobject/libvirt-gobject-connection.c b/libvirt-gobject/libvirt-gobject-connection.c
index 0525323..6888482 100644
--- a/libvirt-gobject/libvirt-gobject-connection.c
+++ b/libvirt-gobject/libvirt-gobject-connection.c
@@ -613,7 +613,7 @@ static gchar ** fetch_list(virConnectPtr vconn,
         if (g_cancellable_set_error_if_cancelled(cancellable, err))
             goto error;
 
-        lst = g_new(gchar *, n);
+        lst = g_new0(gchar *, n);
         if ((n = list_func(vconn, lst, n)) < 0) {
             gvir_set_error(err, GVIR_CONNECTION_ERROR,
                            0,
@@ -626,9 +626,11 @@ static gchar ** fetch_list(virConnectPtr vconn,
     return lst;
 
 error:
-    for (i = 0 ; i < n; i++)
-        g_free(lst[i]);
-    g_free(lst);
+    if (lst != NULL) {
+        for (i = 0 ; i < n; i++)
+            g_free(lst[i]);
+        g_free(lst);
+    }
     return NULL;
 }
 
diff --git a/libvirt-gobject/libvirt-gobject-storage-pool.c b/libvirt-gobject/libvirt-gobject-storage-pool.c
index 8f579a1..16b39d4 100644
--- a/libvirt-gobject/libvirt-gobject-storage-pool.c
+++ b/libvirt-gobject/libvirt-gobject-storage-pool.c
@@ -333,7 +333,7 @@ static gchar ** fetch_list(virStoragePoolPtr vpool,
         if (g_cancellable_set_error_if_cancelled(cancellable, err))
             goto error;
 
-        lst = g_new(gchar *, n);
+        lst = g_new0(gchar *, n);
         if ((n = list_func(vpool, lst, n)) < 0) {
             gvir_set_error(err, GVIR_STORAGE_POOL_ERROR,
                            0,
@@ -346,9 +346,11 @@ static gchar ** fetch_list(virStoragePoolPtr vpool,
     return lst;
 
 error:
-    for (i = 0 ; i < n; i++)
-        g_free(lst[i]);
-    g_free(lst);
+    if (lst != NULL) {
+        for (i = 0 ; i < n; i++)
+            g_free(lst[i]);
+        g_free(lst);
+    }
     return NULL;
 }
 
-- 
1.8.0.2

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list