[libvirt] [PATCH 2/2] conf: Fix leaks in virNetworkObjUpdateParseFile

[Laine Stump]

On 01/25/2013 10:36 AM, Ján Tomko wrote:
> Free the bitmap before calling virBitmapParse, which will overwrite it.
>
> Also free xml.
> ---
>  src/conf/network_conf.c |   19 +++++++++++--------
>  1 files changed, 11 insertions(+), 8 deletions(-)
>
> diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
> index c93916d..013333c 100644
> --- a/src/conf/network_conf.c
> +++ b/src/conf/network_conf.c
> @@ -1855,14 +1855,16 @@ virNetworkObjUpdateParseFile(const char *filename,
>  
>          ctxt->node = node;
>          class_id = virXPathString("string(./class_id[1]/@bitmap)", ctxt);
> -        if (class_id &&
> -            virBitmapParse(class_id, 0,
> -                           &net->class_id, CLASS_ID_BITMAP_SIZE) < 0) {
> -            virReportError(VIR_ERR_INTERNAL_ERROR,
> -                           _("Malformed 'class_id' attribute: %s"),
> -                           class_id);
> -            VIR_FREE(class_id);
> -            goto cleanup;
> +        if (class_id) {
> +            virBitmapFree(net->class_id);

If there is a situation where this function can be called and
net->class_id is already filled in, then doesn't that also mean that
net->floor_sum could have already been set?

If that's the case, then we need to also set net->floor_sum to 0, in
case it was previously non-0 and the new status doesn't have anything
set (implying 0).

If not, then this virBitmapFree() is a NOP.

> +            if (virBitmapParse(class_id, 0,
> +                               &net->class_id, CLASS_ID_BITMAP_SIZE) < 0) {
> +                virReportError(VIR_ERR_INTERNAL_ERROR,
> +                               _("Malformed 'class_id' attribute: %s"),
> +                               class_id);
> +                VIR_FREE(class_id);
> +                goto cleanup;
> +            }
>          }
>          VIR_FREE(class_id);
>  
> @@ -1896,6 +1898,7 @@ virNetworkObjUpdateParseFile(const char *filename,
>  
>  cleanup:
>      xmlXPathFreeContext(ctxt);
> +    xmlFreeDoc(xml);
>      return ret;
>  }
>