Commit 632180d1 introduced memory corruption in xenDaemonListDefinedDomains by starting to populate the names array at index -1, causing all sorts of havoc in libvirtd such as aborts like the following *** Error in `/usr/sbin/libvirtd': double free or corruption (out): 0x00007fffe00ccf20 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x7abf6)[0x7ffff3fa0bf6] /lib64/libc.so.6(+0x7b973)[0x7ffff3fa1973] /lib64/libc.so.6(xdr_array+0xde)[0x7ffff403cbae] /usr/sbin/libvirtd(+0x50251)[0x5555555a4251] /lib64/libc.so.6(xdr_free+0x15)[0x7ffff403ccd5] /usr/lib64/libvirt.so.0(+0x1fad34)[0x7ffff76b1d34] /usr/lib64/libvirt.so.0(virNetServerProgramDispatch+0x1fc)[0x7ffff76b16f1] /usr/lib64/libvirt.so.0(+0x1f214a)[0x7ffff76a914a] /usr/lib64/libvirt.so.0(+0x1f222d)[0x7ffff76a922d] /usr/lib64/libvirt.so.0(+0xbcc4f)[0x7ffff7573c4f] /usr/lib64/libvirt.so.0(+0xbc5e5)[0x7ffff75735e5] /lib64/libpthread.so.0(+0x7e0f)[0x7ffff48f7e0f] /lib64/libc.so.6(clone+0x6d)[0x7ffff400e7dd] Fix by initializing ret to 0 and only setting to error on failure path. --- src/xen/xend_internal.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/xen/xend_internal.c b/src/xen/xend_internal.c index 1ce36e6..f698c8d 100644 --- a/src/xen/xend_internal.c +++ b/src/xen/xend_internal.c @@ -2896,7 +2896,7 @@ xenDaemonListDefinedDomains(virConnectPtr conn, { struct sexpr *root = NULL; size_t i; - int ret = -1; + int ret = 0; struct sexpr *_for_i, *node; if (maxnames == 0) @@ -2919,16 +2919,15 @@ xenDaemonListDefinedDomains(virConnectPtr conn, break; } - ret = 0; - cleanup: sexpr_free(root); return ret; error: - for (i = 0; ret != -1 && i < ret; ++i) + for (i = 0; i < ret; ++i) VIR_FREE(names[i]); + ret = -1; goto cleanup; } -- 1.8.1.4