[libvirt] [PATCH] qemu: Fix crash on failed VM startup
Eric Blake
eblake at redhat.com
Tue Jun 1 20:03:20 UTC 2010
On 06/01/2010 01:10 PM, Cole Robinson wrote:
> If VM startup fails early enough (can't find a referenced USB device),
> libvirtd will crash trying to clear the VNC port bit, since port = 0,
> which overflows us out of the bitmap bounds.
>
> Fix this by being more defensive in the bitmap operations, and only
> clearing a previously set VNC port.
>
> +++ b/src/util/bitmap.c
> @@ -118,7 +118,7 @@ int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
> */
> int virBitmapClearBit(virBitmapPtr bitmap, size_t b)
> {
> - if (b > bitmap->size - 1)
> + if (bitmap->size != 0 && b > bitmap->size - 1)
I think this could use a v2: virBitmapSetBit and virBitmapGetBit should
get the same treatment for bounds checking.
Meanwhile, we already reject attempts to create a bitmap with SIZE_MAX
bits. Therefore, since b is unsigned, we can safely avoid the && and
instead do the computation via a single comparison:
if (bitmap->size <= b)
return -1;
For that matter, should virBitmapAlloc(0) return NULL, instead of it's
current behavior of allocating an (empty) bitmap?
--
Eric Blake eblake at redhat.com +1-801-349-2682
Libvirt virtualization library http://libvirt.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 619 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20100601/a5c7574f/attachment-0001.sig>
More information about the libvir-list
mailing list