[libvirt] unchecked malloc+syscall uses

Jim Meyering jim at meyering.net
Fri Jun 26 15:45:59 UTC 2009


I was looking through recent changes and spotted two potential
NULL-dereferences in this change set:

    http://git.et.redhat.com/?p=libvirt.git;a=commitdiff;h=70c01b4c1adea75e9

In src/opennebula/one_client.c:

+    one_client.url=(char *)malloc(64);
+    snprintf(one_client.url, 63, "http://localhost:%d/RPC2", ONED_PORT);
+#else
+    one_client.url=(char *)"http://localhost:2633/RPC2";
+#endif
--
+    file_text=(char *)malloc(size+1);
+    bytes_read=read(file, file_text, size);
+    close(file);
+
+    if(bytes_read==size) {

Perhaps of more immediate concern,
these syscalls are not checked for failure:

+    file=open(template_file, O_RDONLY);
+    size=lseek(file, 0, SEEK_END);
+    lseek(file, 0, SEEK_SET);

and same for the "read" syscall above.

Note, this is just the result of a few minutes cursory review.




More information about the libvir-list mailing list