From: "Daniel P. Berrange" <berrange@xxxxxxxxxx>
The xenParseSxpr method sets def->nconsoles to 1 before allocating
the def->consoles array. If the allocation fails due to OOM the
cleanup code will thus crash accessing out of bounds.
Signed-off-by: Daniel P. Berrange <berrange@xxxxxxxxxx>
---
src/xenxs/xen_sxpr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/xenxs/xen_sxpr.c b/src/xenxs/xen_sxpr.c
index 6209c68..462eac6 100644
--- a/src/xenxs/xen_sxpr.c
+++ b/src/xenxs/xen_sxpr.c
@@ -1439,9 +1439,9 @@ xenParseSxpr(const struct sexpr *root,
def->parallels[def->nparallels++] = chr;
}
} else if (def->id != 0) {
- def->nconsoles = 1;
if (VIR_ALLOC_N(def->consoles, 1) < 0)
goto error;
+ def->nconsoles = 1;
/* Fake a paravirt console, since that's not in the sexpr */
if (!(def->consoles[0] = xenParseSxprChar("pty", tty)))
goto error;
--
1.8.3.1
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list