Re: [PATCH 1/2] conf: avoid null deref during storage probe

[Martin Kletzander <mkletzan@xxxxxxxxxx>]

On Mon, Apr 28, 2014 at 09:53:54PM -0600, Eric Blake wrote:
> Commit 5c43e2e introduced a NULL deref if there is a failure
> in virStorageFileGetMetadataInternal.
>
> * src/util/virstoragefile.c (virStorageFileGetMetadataFromBuf):
> Fix error handling.
>
> Signed-off-by: Eric Blake <eblake@xxxxxxxxxx>
> ---
> src/util/virstoragefile.c | 22 +++++++++++-----------
> 1 file changed, 11 insertions(+), 11 deletions(-)

ACK,

Martin

> diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c
> index 1ce0fa1..dcce1ef 100644
> --- a/src/util/virstoragefile.c
> +++ b/src/util/virstoragefile.c
> @@ -999,21 +999,21 @@ virStorageFileGetMetadataFromBuf(const char *path,
>                                  int *backingFormat)
> {
>     virStorageSourcePtr ret = NULL;
> +    virStorageSourcePtr meta = NULL;
>
> -    if (!(ret = virStorageFileMetadataNew(path, format)))
> +    if (!(meta = virStorageFileMetadataNew(path, format)))
>         return NULL;
>
> -    if (virStorageFileGetMetadataInternal(ret, buf, len,
> -                                          backingFormat) < 0) {
> -        virStorageSourceFree(ret);
> -        ret = NULL;
> -    }
> -
> -    if (VIR_STRDUP(*backing, ret->backingStoreRaw) < 0) {
> -        virStorageSourceFree(ret);
> -        ret = NULL;
> -    }
> +    if (virStorageFileGetMetadataInternal(meta, buf, len,
> +                                          backingFormat) < 0)
> +        goto cleanup;
> +    if (VIR_STRDUP(*backing, meta->backingStoreRaw) < 0)
> +        goto cleanup;
>
> +    ret = meta;
> +    meta = NULL;
> + cleanup:
> +    virStorageSourceFree(meta);
>     return ret;
> }

Attachment: signature.asc
Description: Digital signature

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list