[libvirt] [PATCH 01/23] Fix crash on OOM in xenParseSxpr

[Laine Stump]

On 09/25/2013 10:50 AM, Daniel P. Berrange wrote:
> From: "Daniel P. Berrange" <berrange at redhat.com>
>
> The xenParseSxpr method sets def->nconsoles to 1 before allocating
> the def->consoles array. If the allocation fails due to OOM the
> cleanup code will thus crash accessing out of bounds.
>
> Signed-off-by: Daniel P. Berrange <berrange at redhat.com>
> ---
>  src/xenxs/xen_sxpr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/xenxs/xen_sxpr.c b/src/xenxs/xen_sxpr.c
> index 6209c68..462eac6 100644
> --- a/src/xenxs/xen_sxpr.c
> +++ b/src/xenxs/xen_sxpr.c
> @@ -1439,9 +1439,9 @@ xenParseSxpr(const struct sexpr *root,
>              def->parallels[def->nparallels++] = chr;
>          }
>      } else if (def->id != 0) {
> -        def->nconsoles = 1;
>          if (VIR_ALLOC_N(def->consoles, 1) < 0)
>              goto error;
> +        def->nconsoles = 1;
>          /* Fake a paravirt console, since that's not in the sexpr */
>          if (!(def->consoles[0] = xenParseSxprChar("pty", tty)))
>              goto error;

ACK