External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-23 06:05:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

conf: check the return value of virXPathNodeSet

Browse Source 
In a few places, the return value could get passed to VIR_ALLOC_N without
being checked, resulting in a request to allocate a lot of memory if the
return value was negative.
This commit is contained in:
Ján Tomko 2012-11-28 14:34:50 +01:00 committed by Osier Yang
parent 924a6c7f6a
commit 34e5791332
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/conf/domain_conf.c
View File

@ -3258,7 +3258,9 @@ virSecurityLabelDefsParseXML(virDomainDefPtr def,
saved_node = ctxt->node; saved_node = ctxt->node;
/* Allocate a security labels based on XML */ /* Allocate a security labels based on XML */
if ((n = virXPathNodeSet("./seclabel", ctxt, &list)) == 0) if ((n = virXPathNodeSet("./seclabel", ctxt, &list)) < 0)
goto error;
if (n == 0)
return 0; return 0;
if (VIR_ALLOC_N(def->seclabels, n) < 0) { if (VIR_ALLOC_N(def->seclabels, n) < 0) {
@ -3345,7 +3347,9 @@ virSecurityDeviceLabelDefParseXML(virSecurityDeviceLabelDefPtr **seclabels_rtn,
virSecurityLabelDefPtr vmDef = NULL; virSecurityLabelDefPtr vmDef = NULL;
char *model, *relabel, *label; char *model, *relabel, *label;
if ((n = virXPathNodeSet("./seclabel", ctxt, &list)) == 0) if ((n = virXPathNodeSet("./seclabel", ctxt, &list)) < 0)
goto error;
if (n == 0)
return 0; return 0;
if (VIR_ALLOC_N(seclabels, n) < 0) { if (VIR_ALLOC_N(seclabels, n) < 0) {

5
src/conf/storage_conf.c
View File

@ -479,6 +479,7 @@ virStoragePoolDefParseSource(xmlXPathContextPtr ctxt,
virStoragePoolOptionsPtr options; virStoragePoolOptionsPtr options;
char *name = NULL; char *name = NULL;
char *port = NULL; char *port = NULL;
int n;
relnode = ctxt->node; relnode = ctxt->node;
ctxt->node = node; ctxt->node = node;
@ -510,7 +511,9 @@ virStoragePoolDefParseSource(xmlXPathContextPtr ctxt,
VIR_FREE(format); VIR_FREE(format);
} }
source->nhost = virXPathNodeSet("./host", ctxt, &nodeset); if ((n = virXPathNodeSet("./host", ctxt, &nodeset)) < 0)
goto cleanup;
source->nhost = n;
if (source->nhost) { if (source->nhost) {
if (VIR_ALLOC_N(source->hosts, source->nhost) < 0) { if (VIR_ALLOC_N(source->hosts, source->nhost) < 0) {