[Libvirt-cim] [PATCH 18/19] Coverity: Resolve USE_AFTER_FREE - lifecycle_thread_native()

John Ferlan jferlan at redhat.com
Thu May 16 14:57:53 UTC 2013


Resolve 2 instances where tmp_list was used after a free, both in the
same location in the loop:

(22) Event pass_freed_arg:
    Passing freed pointer "tmp_list" as an argument to function
    "doms_to_xml(struct dom_xml **, virDomainPtr *, int)".

658                     s = doms_to_xml(&cur_xml, tmp_list, cur_count);
659                     free_domain_list(tmp_list, cur_count);

(10) Event freed_arg:
    "free(void *)" frees "tmp_list".

660                     free(tmp_list);

Resolve by setting "tmp_list = NULL;" after each free.
---
 src/Virt_ComputerSystemIndication.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/Virt_ComputerSystemIndication.c b/src/Virt_ComputerSystemIndication.c
index 04e4d89..086d8c4 100644
--- a/src/Virt_ComputerSystemIndication.c
+++ b/src/Virt_ComputerSystemIndication.c
@@ -638,6 +638,7 @@ static CMPI_THREAD_RETURN lifecycle_thread_native(void *params)
         s = doms_to_xml(&prev_xml, tmp_list, prev_count);
         free_domain_list(tmp_list, prev_count);
         free(tmp_list);
+        tmp_list = NULL;
         if (s.rc != CMPI_RC_OK) {
                 CU_DEBUG("doms_to_xml failed.  Attempting to continue.");
         }
@@ -657,6 +658,7 @@ static CMPI_THREAD_RETURN lifecycle_thread_native(void *params)
                 s = doms_to_xml(&cur_xml, tmp_list, cur_count);
                 free_domain_list(tmp_list, cur_count);
                 free(tmp_list);
+                tmp_list = NULL;
                 if (s.rc != CMPI_RC_OK) {
                         CU_DEBUG("doms_to_xml failed. retry in %d seconds",
                                  retry_time);
-- 
1.8.1.4




More information about the Libvirt-cim mailing list