External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-24 06:35:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

lxc: avoid null deref on lxcSetupLoopDevices failure

Browse Source 
If the function lxcSetupLoopDevices(def, &nloopDevs, &loopDevs) failed,
the variable loopDevs will keep a initial NULL value, however, the
function VIR_FORCE_CLOSE(loopDevs[i]) will directly deref it.

This patch also fixes returning a bogous number of devices from
lxcSetupLoopDevices on an error path.

* rc/lxc/lxc_controller.c: fixed a null pointer dereference.

Signed-off-by: Alex Jia <ajia@redhat.com>
This commit is contained in:
Alex Jia 2011-10-27 15:18:00 +08:00 committed by Peter Krempa
parent d2dff42598
commit 3fd2b1e9d0
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/lxc/lxc_controller.c
View File

@ -208,6 +208,7 @@ static int lxcSetupLoopDevices(virDomainDefPtr def, size_t *nloopDevs, int **loo
VIR_DEBUG("Saving loop fd %d", fd); VIR_DEBUG("Saving loop fd %d", fd);
if (VIR_REALLOC_N(*loopDevs, *nloopDevs+1) < 0) { if (VIR_REALLOC_N(*loopDevs, *nloopDevs+1) < 0) {
*nloopDevs = 0;
VIR_FORCE_CLOSE(fd); VIR_FORCE_CLOSE(fd);
virReportOOMError(); virReportOOMError();
goto cleanup; goto cleanup;
@ -1017,8 +1018,11 @@ cleanup:
VIR_FORCE_CLOSE(containerhandshake[0]); VIR_FORCE_CLOSE(containerhandshake[0]);
VIR_FORCE_CLOSE(containerhandshake[1]); VIR_FORCE_CLOSE(containerhandshake[1]);
for (i = 0 ; i < nloopDevs ; i++) if (loopDevs) {
VIR_FORCE_CLOSE(loopDevs[i]); for (i = 0 ; i < nloopDevs ; i++)
VIR_FORCE_CLOSE(loopDevs[i]);
}
VIR_FREE(loopDevs); VIR_FREE(loopDevs);
if (container > 1) { if (container > 1) {