External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-22 04:25:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

remote: fix crash on OOM

Browse Source 
Bug introduced in commit 675464b.  On an OOM, this would try to
dereference a char* and free the contents as a pointer, which is
doomed to failure.

Adding a syntax check will prevent mistakes like this in the future.

* cfg.mk (sc_prohibit_internal_functions): New syntax check.
(exclude_file_name_regexp--sc_prohibit_internal_functions): Add
exemptions.
* daemon/remote.c (remoteRelayDomainEventIOError)
(remoteRelayDomainEventIOErrorReason)
(remoteRelayDomainEventGraphics, remoteRelayDomainEventBlockJob):
Use correct free function.
This commit is contained in:
Eric Blake 2011-09-20 12:11:32 -06:00 committed by Daniel Veillard
parent 7d7a7e291b
commit 2b0803c64f
2 changed files with 24 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
cfg.mk
View File

@ -212,7 +212,7 @@ useless_free_options = \
# y virDomainWatchdogDefFree # y virDomainWatchdogDefFree
# n virDrvNodeGetCellsFreeMemory (returns int) # n virDrvNodeGetCellsFreeMemory (returns int)
# n virDrvNodeGetFreeMemory (returns long long) # n virDrvNodeGetFreeMemory (returns long long)
# n virFree (dereferences param) # n virFree - dereferences param
# n virFreeError # n virFreeError
# n virHashFree (takes 2 args) # n virHashFree (takes 2 args)
# y virInterfaceDefFree # y virInterfaceDefFree
@ -306,6 +306,12 @@ sc_flags_usage:
halt='flags should be unsigned' \ halt='flags should be unsigned' \
$(_sc_search_regexp) $(_sc_search_regexp)
# Avoid functions that should only be called via macro counterparts.
sc_prohibit_internal_functions:
@prohibit='vir(Free|AllocN?|ReallocN|File(Close|Fclose|Fdopen)) *\(' \
halt='use VIR_ macros instead of internal functions' \
$(_sc_search_regexp)
# Avoid functions that can lead to double-close bugs. # Avoid functions that can lead to double-close bugs.
sc_prohibit_close: sc_prohibit_close:
@prohibit='([^>.]|^)\<[fp]?close *\(' \ @prohibit='([^>.]|^)\<[fp]?close *\(' \
@ -706,6 +712,9 @@ exclude_file_name_regexp--sc_prohibit_fork_wrappers = \
exclude_file_name_regexp--sc_prohibit_gethostname = ^src/util/util\.c$$ exclude_file_name_regexp--sc_prohibit_gethostname = ^src/util/util\.c$$
exclude_file_name_regexp--sc_prohibit_internal_functions = \
^src/(util/(memory|util|virfile)\.[hc]|esx/esx_vi\.c)$$
exclude_file_name_regexp--sc_prohibit_newline_at_end_of_diagnostic = \ exclude_file_name_regexp--sc_prohibit_newline_at_end_of_diagnostic = \
^src/rpc/gendispatch\.pl$$ ^src/rpc/gendispatch\.pl$$

28
daemon/remote.c
View File

@ -250,8 +250,8 @@ static int remoteRelayDomainEventIOError(virConnectPtr conn ATTRIBUTE_UNUSED,
return 0; return 0;
mem_error: mem_error:
virReportOOMError(); virReportOOMError();
virFree(data.srcPath); VIR_FREE(data.srcPath);
virFree(data.devAlias); VIR_FREE(data.devAlias);
return -1; return -1;
} }
@ -296,9 +296,9 @@ static int remoteRelayDomainEventIOErrorReason(virConnectPtr conn ATTRIBUTE_UNUS
mem_error: mem_error:
virReportOOMError(); virReportOOMError();
virFree(data.srcPath); VIR_FREE(data.srcPath);
virFree(data.devAlias); VIR_FREE(data.devAlias);
virFree(data.reason); VIR_FREE(data.reason);
return -1; return -1;
} }
@ -374,17 +374,17 @@ static int remoteRelayDomainEventGraphics(virConnectPtr conn ATTRIBUTE_UNUSED,
mem_error: mem_error:
virReportOOMError(); virReportOOMError();
virFree(data.authScheme); VIR_FREE(data.authScheme);
virFree(data.local.node); VIR_FREE(data.local.node);
virFree(data.local.service); VIR_FREE(data.local.service);
virFree(data.remote.node); VIR_FREE(data.remote.node);
virFree(data.remote.service); VIR_FREE(data.remote.service);
if (data.subject.subject_val != NULL) { if (data.subject.subject_val != NULL) {
for (i = 0 ; i < data.subject.subject_len ; i++) { for (i = 0 ; i < data.subject.subject_len ; i++) {
virFree(data.subject.subject_val[i].type); VIR_FREE(data.subject.subject_val[i].type);
virFree(data.subject.subject_val[i].name); VIR_FREE(data.subject.subject_val[i].name);
} }
virFree(data.subject.subject_val); VIR_FREE(data.subject.subject_val);
} }
return -1; return -1;
} }
@ -422,7 +422,7 @@ static int remoteRelayDomainEventBlockJob(virConnectPtr conn ATTRIBUTE_UNUSED,
mem_error: mem_error:
virReportOOMError(); virReportOOMError();
virFree(data.path); VIR_FREE(data.path);
return -1; return -1;
} }