[libvirt] [PATCH] storage: avoid null deref on qemu-img failure

[Eric Blake]

On 10/21/2011 04:17 PM, Peter Krempa wrote:
> Dňa 21.10.2011 23:39, Eric Blake wrote / napísal(a):
>> Detected by Coverity. Only possible if qemu-img gives bogus output,
>> but we might as well be robust.
>>
>> * src/storage/storage_backend.c
>> (virStorageBackendQEMUImgBackingFormat): Check for strstr failure.
>> ---

>> - start = strstr(help, " create ");
>> - end = strstr(start, "\n");
>> + if ((start = strstr(help, " create ")) == NULL ||
>> + (end = strstr(start, "\n")) == NULL)
>> + goto cleanup;
>
> At least one call graph to this function does not contain adding a error
> message of any kind. I think it would be fair to inform the user if his
> qemu-img is somehow broken (although unlikely to happen), if we check
> for this now.

I squashed this in:

diff --git i/src/storage/storage_backend.c w/src/storage/storage_backend.c
index 7c8bfdc..93c98d6 100644
--- i/src/storage/storage_backend.c
+++ w/src/storage/storage_backend.c
@@ -632,8 +632,12 @@ static int 
virStorageBackendQEMUImgBackingFormat(const char *qemuimg)
          goto cleanup;

      if ((start = strstr(help, " create ")) == NULL ||
-        (end = strstr(start, "\n")) == NULL)
+        (end = strstr(start, "\n")) == NULL) {
+        virStorageReportError(VIR_ERR_INTERNAL_ERROR,
+                              _("unable to parse qemu-img output '%s'"),
+                              help);
          goto cleanup;
+    }
      if (((tmp = strstr(start, "-F fmt")) && tmp < end) ||
          ((tmp = strstr(start, "-F backing_fmt")) && tmp < end))
          ret = QEMU_IMG_BACKING_FORMAT_FLAG;



> ACK,

and pushed.  Thanks for the review.

-- 
Eric Blake   eblake at redhat.com    +1-801-349-2682
Libvirt virtualization library http://libvirt.org