[libvirt PATCH 3/4] remote: Avoid leaking uri_out

Jiri Denemark jdenemar at redhat.com
Thu Jan 26 10:29:23 UTC 2023


In case the API returned success and a NULL pointer in uri_out, we would
leak the preallocated buffer used for storing the uri_out pointer.

Signed-off-by: Jiri Denemark <jdenemar at redhat.com>
---
 src/remote/remote_daemon_dispatch.c | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
index dbe6825fb8..6cf88e22c3 100644
--- a/src/remote/remote_daemon_dispatch.c
+++ b/src/remote/remote_daemon_dispatch.c
@@ -3061,15 +3061,14 @@ remoteDispatchDomainMigratePrepare2(virNetServer *server G_GNUC_UNUSED,
      */
     ret->cookie.cookie_len = cookielen;
     ret->cookie.cookie_val = cookie;
-    ret->uri_out = *uri_out == NULL ? NULL : uri_out;
+    ret->uri_out = *uri_out == NULL ? NULL : g_steal_pointer(&uri_out);
 
     rv = 0;
 
  cleanup:
-    if (rv < 0) {
+    if (rv < 0)
         virNetMessageSaveError(rerr);
-        VIR_FREE(uri_out);
-    }
+    VIR_FREE(uri_out);
     return rv;
 }
 
@@ -4776,15 +4775,14 @@ remoteDispatchDomainMigratePrepare3(virNetServer *server G_GNUC_UNUSED,
      */
     ret->cookie_out.cookie_out_len = cookieoutlen;
     ret->cookie_out.cookie_out_val = cookieout;
-    ret->uri_out = *uri_out == NULL ? NULL : uri_out;
+    ret->uri_out = *uri_out == NULL ? NULL : g_steal_pointer(&uri_out);
 
     rv = 0;
 
  cleanup:
-    if (rv < 0) {
+    if (rv < 0)
         virNetMessageSaveError(rerr);
-        VIR_FREE(uri_out);
-    }
+    VIR_FREE(uri_out);
     return rv;
 }
 
@@ -5572,16 +5570,15 @@ remoteDispatchDomainMigratePrepare3Params(virNetServer *server G_GNUC_UNUSED,
 
     ret->cookie_out.cookie_out_len = cookieoutlen;
     ret->cookie_out.cookie_out_val = cookieout;
-    ret->uri_out = !*uri_out ? NULL : uri_out;
+    ret->uri_out = !*uri_out ? NULL : g_steal_pointer(&uri_out);
 
     rv = 0;
 
  cleanup:
     virTypedParamsFree(params, nparams);
-    if (rv < 0) {
+    if (rv < 0)
         virNetMessageSaveError(rerr);
-        VIR_FREE(uri_out);
-    }
+    VIR_FREE(uri_out);
     return rv;
 }
 
-- 
2.39.1



More information about the libvir-list mailing list