[libvirt] [PATCH 1/4] Set the number of elements to 0 in virNetwork*Clear

Michal Privoznik mprivozn at redhat.com
Fri Jul 26 10:36:38 UTC 2013


On 26.07.2013 12:28, Ján Tomko wrote:
> Leaving it at -1 causes invalid free in virNetworkDefUpdateDNSHost
> if virNetworkDNSHostDefParseXML fails and virNetworkDNSHostDefClear
> gets called twice.
> ---
>  src/conf/network_conf.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
> index d616e12..e3e0e89 100644
> --- a/src/conf/network_conf.c
> +++ b/src/conf/network_conf.c
> @@ -136,6 +136,7 @@ virNetworkIpDefClear(virNetworkIpDefPtr def)
>  
>      while (def->nhosts--)
>          virNetworkDHCPHostDefClear(&def->hosts[def->nhosts]);
> +    def->nhosts = 0;

I think we need a sligthly different approach here. What if def->nhost
is 0 before entering the while() loop? It gets decreased to -1 and ...
We need:

while (def->nhosts)
  virNetworkDHCPHostDefCelar( .... [--def->nhosts]);

or just use for (i = 0; i < def->nhosts; i++)
  theFunction( ...[i]);

Michal




More information about the libvir-list mailing list