External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-03-07 17:28:15 +00:00
Code

rpc: Fix potentially segfaults

Browse Source 
We have to allocate first and if, and only if, it was successful we
can set the count. A segfault has occurred in
virNetServerServiceNewPostExecRestart() when VIR_ALLOC_N(svc->socks,
n) has failed, but svc->nsocsk = n was already set. Thus
virObejectUnref(svc) was called and therefore it was possible that
virNetServerServiceDispose was called => segmentation fault.  For
safeness NULL pointer check were added in
virNetServerServiceDispose().

Signed-off-by: Marc Hartmayer <mhartmay@linux.vnet.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com>
Reviewed-by: Bjoern Walk <bwalk@linux.vnet.ibm.com>
This commit is contained in:
Marc Hartmayer 2017-02-09 15:13:38 +01:00 committed by Laine Stump
parent 5620c60959
commit d6bc7622f0
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/rpc/virnetserverservice.c
View File

@ -228,9 +228,9 @@ virNetServerServicePtr virNetServerServiceNewUNIX(const char *path,
svc->tls = virObjectRef(tls);
#endif
svc->nsocks = 1;
if (VIR_ALLOC_N(svc->socks, svc->nsocks) < 0)
if (VIR_ALLOC_N(svc->socks, 1) < 0)
goto error;
svc->nsocks = 1;
if (virNetSocketNewListenUNIX(path,
mask,
@ -289,9 +289,9 @@ virNetServerServicePtr virNetServerServiceNewFD(int fd,
svc->tls = virObjectRef(tls);
#endif
svc->nsocks = 1;
if (VIR_ALLOC_N(svc->socks, svc->nsocks) < 0)
if (VIR_ALLOC_N(svc->socks, 1) < 0)
goto error;
svc->nsocks = 1;
if (virNetSocketNewListenFD(fd,
&svc->socks[0]) < 0)
@ -367,9 +367,9 @@ virNetServerServicePtr virNetServerServiceNewPostExecRestart(virJSONValuePtr obj
goto error;
}
svc->nsocks = n;
if (VIR_ALLOC_N(svc->socks, svc->nsocks) < 0)
if (VIR_ALLOC_N(svc->socks, n) < 0)
goto error;
svc->nsocks = n;
for (i = 0; i < svc->nsocks; i++) {
virJSONValuePtr child = virJSONValueArrayGet(socks, i);
@ -493,7 +493,7 @@ void virNetServerServiceDispose(void *obj)
size_t i;
for (i = 0; i < svc->nsocks; i++)
virObjectUnref(svc->socks[i]);
virObjectUnref(svc->socks[i]);
VIR_FREE(svc->socks);
#if WITH_GNUTLS