External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-03-07 17:28:15 +00:00
Code

xen: fix memory corruption in legacy driver

Browse Source 
Commit 632180d1 introduced memory corruption in xenDaemonListDefinedDomains
by starting to populate the names array at index -1, causing all sorts
of havoc in libvirtd such as aborts like the following

*** Error in `/usr/sbin/libvirtd': double free or corruption (out): 0x00007fffe00ccf20 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x7abf6)[0x7ffff3fa0bf6]
/lib64/libc.so.6(+0x7b973)[0x7ffff3fa1973]
/lib64/libc.so.6(xdr_array+0xde)[0x7ffff403cbae]
/usr/sbin/libvirtd(+0x50251)[0x5555555a4251]
/lib64/libc.so.6(xdr_free+0x15)[0x7ffff403ccd5]
/usr/lib64/libvirt.so.0(+0x1fad34)[0x7ffff76b1d34]
/usr/lib64/libvirt.so.0(virNetServerProgramDispatch+0x1fc)[0x7ffff76b16f1]
/usr/lib64/libvirt.so.0(+0x1f214a)[0x7ffff76a914a]
/usr/lib64/libvirt.so.0(+0x1f222d)[0x7ffff76a922d]
/usr/lib64/libvirt.so.0(+0xbcc4f)[0x7ffff7573c4f]
/usr/lib64/libvirt.so.0(+0xbc5e5)[0x7ffff75735e5]
/lib64/libpthread.so.0(+0x7e0f)[0x7ffff48f7e0f]
/lib64/libc.so.6(clone+0x6d)[0x7ffff400e7dd]

Fix by initializing ret to 0 and only setting to error on failure path.
This commit is contained in:
Jim Fehlig 2013-08-05 10:27:23 -06:00
parent 1199edb1d4
commit 0e671a1646
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/xen/xend_internal.c
View File

@ -2896,7 +2896,7 @@ xenDaemonListDefinedDomains(virConnectPtr conn,
{
struct sexpr *root = NULL;
size_t i;
int ret = -1;
int ret = 0;
struct sexpr *_for_i, *node;
if (maxnames == 0)
@ -2919,16 +2919,15 @@ xenDaemonListDefinedDomains(virConnectPtr conn,
break;
}
ret = 0;
cleanup:
sexpr_free(root);
return ret;
error:
for (i = 0; ret != -1 && i < ret; ++i)
for (i = 0; i < ret; ++i)
VIR_FREE(names[i]);
ret = -1;
goto cleanup;
}