From 79e09184e3e879624030af46b7e687a835f9d928 Mon Sep 17 00:00:00 2001 From: Jim Fehlig Date: Thu, 13 Apr 2017 10:39:52 -0600 Subject: [PATCH] xenconfig: avoid double free on OOM testing Fix xlconfig channel tests when OOM testing is enabled. TEST: xlconfigtest 32) Xen XL-2-XML Format channel-unix ... OK Test OOM for nalloc=55 ................................................*** Error in `/home/jfehlig/virt/upstream/libvirt/tests/.libs/xlconfigtest': double free or corruption (fasttop): 0x0000000000679550 *** ... (gdb) bt #0 0x00007ffff36875af in raise () from /lib64/libc.so.6 #1 0x00007ffff36889aa in abort () from /lib64/libc.so.6 #2 0x00007ffff36c5150 in __libc_message () from /lib64/libc.so.6 #3 0x00007ffff36cb4f6 in malloc_printerr () from /lib64/libc.so.6 #4 0x00007ffff36cbcee in _int_free () from /lib64/libc.so.6 #5 0x00007ffff782babf in virFree (ptrptr=0x7fffffffdca8) at util/viralloc.c:582 #6 0x000000000042f2f3 in xenParseXLChannel (conf=0x677350, def=0x6815b0) at xenconfig/xen_xl.c:788 #7 0x000000000042f44e in xenParseXL (conf=0x677350, caps=0x6832b0, xmlopt=0x67f6e0) at xenconfig/xen_xl.c:828 #8 0x00000000004105a3 in testCompareFormatXML ( xlcfg=0x6811e0 "/home/jfehlig/virt/upstream/libvirt/tests/xlconfigdata/test-channel-unix.cfg", xml=0x681110 "/home/jfehlig/virt/upstream/libvirt/tests/xlconfigdata/test-channel-unix.xml", replaceVars=false) at xlconfigtest.c:152 When a channel is successfully parsed and its path and name fields assigned from local variables, set the local variables to NULL to prevent a double free on error. Signed-off-by: Jim Fehlig (cherry picked from commit b2c12f5765d4d2a430fc5d252674ef39ba9d75f3) --- src/xenconfig/xen_xl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/xenconfig/xen_xl.c b/src/xenconfig/xen_xl.c index 43ecf41148..a5b342a865 100644 --- a/src/xenconfig/xen_xl.c +++ b/src/xenconfig/xen_xl.c @@ -759,8 +759,9 @@ xenParseXLChannel(virConfPtr conf, virDomainDefPtr def) if (STRPREFIX(type, "socket")) { channel->source->type = VIR_DOMAIN_CHR_TYPE_UNIX; - channel->source->data.nix.path = path; channel->source->data.nix.listen = 1; + channel->source->data.nix.path = path; + path = NULL; } else if (STRPREFIX(type, "pty")) { channel->source->type = VIR_DOMAIN_CHR_TYPE_PTY; VIR_FREE(path); @@ -771,6 +772,7 @@ xenParseXLChannel(virConfPtr conf, virDomainDefPtr def) channel->deviceType = VIR_DOMAIN_CHR_DEVICE_TYPE_CHANNEL; channel->targetType = VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_XEN; channel->target.name = name; + name = NULL; if (VIR_APPEND_ELEMENT(def->channels, def->nchannels, channel) < 0) goto cleanup;