Currently xen_get_nr_phys_cpus() doesn't write to xen_phys_notes if allocation fails, but it doesn't return an error either, leaving xen_phys_notes wide open to be accessed by other functions later. Signed-off-by: Simon Horman <horms at verge.net.au> Index: kexec-tools-unstable/kexec/crashdump-xen.c =================================================================== --- kexec-tools-unstable.orig/kexec/crashdump-xen.c 2007-05-09 18:44:48.000000000 +0900 +++ kexec-tools-unstable/kexec/crashdump-xen.c 2007-05-09 18:50:14.000000000 +0900 @@ -93,13 +93,12 @@ int xen_get_nr_phys_cpus(void) if ((cpus = kexec_iomem_for_each_line(match, NULL, NULL))) { n = sizeof(struct crash_note_info) * cpus; xen_phys_notes = malloc(n); - if (xen_phys_notes) { - memset(xen_phys_notes, 0, n); - kexec_iomem_for_each_line(match, - xen_crash_note_callback, - NULL); + if (!xen_phys_notes) { + fprintf(stderr, "failed to allocate xen_phys_notes.\n"); + return -1; } - + memset(xen_phys_notes, 0, n); + kexec_iomem_for_each_line(match, xen_crash_note_callback, NULL); xen_phys_cpus = cpus; }