[libvirt] [PATCH] xen: fix memory corruption in legacy driver

[Eric Blake]

On 08/05/2013 10:39 AM, Jim Fehlig wrote:
> Commit 632180d1 introduced memory corruption in xenDaemonListDefinedDomains
> by starting to populate the names array at index -1, causing all sorts
> of havoc in libvirtd such as aborts like the following
> 
> *** Error in `/usr/sbin/libvirtd': double free or corruption (out): 0x00007fffe00ccf20 ***
> ======= Backtrace: =========
> /lib64/libc.so.6(+0x7abf6)[0x7ffff3fa0bf6]
> /lib64/libc.so.6(+0x7b973)[0x7ffff3fa1973]
> /lib64/libc.so.6(xdr_array+0xde)[0x7ffff403cbae]
> /usr/sbin/libvirtd(+0x50251)[0x5555555a4251]
> /lib64/libc.so.6(xdr_free+0x15)[0x7ffff403ccd5]
> /usr/lib64/libvirt.so.0(+0x1fad34)[0x7ffff76b1d34]
> /usr/lib64/libvirt.so.0(virNetServerProgramDispatch+0x1fc)[0x7ffff76b16f1]
> /usr/lib64/libvirt.so.0(+0x1f214a)[0x7ffff76a914a]
> /usr/lib64/libvirt.so.0(+0x1f222d)[0x7ffff76a922d]
> /usr/lib64/libvirt.so.0(+0xbcc4f)[0x7ffff7573c4f]
> /usr/lib64/libvirt.so.0(+0xbc5e5)[0x7ffff75735e5]
> /lib64/libpthread.so.0(+0x7e0f)[0x7ffff48f7e0f]
> /lib64/libc.so.6(clone+0x6d)[0x7ffff400e7dd]
> 
> Fix by initializing ret to 0 and only setting to error on failure path.
> ---
>  src/xen/xend_internal.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)

ACK.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20130805/427caefd/attachment-0001.sig>