there is a segfault in the vbox driver when taking a snapshot in the following functions: - vboxDomainGetXMLDesc - vboxSnapshotGetReadWriteDisks - vboxSnapshotGetReadOnlyDisks The virStorageSourcePtr in virDomainDiskDef was not correctly allocated. --- src/vbox/vbox_tmpl.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 1ed2729..6365f2a 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -2872,10 +2872,12 @@ static char *vboxDomainGetXMLDesc(virDomainPtr dom, unsigned int flags) { /* Allocate mem, if fails return error */ if (VIR_ALLOC_N(def->disks, def->ndisks) >= 0) { for (i = 0; i < def->ndisks; i++) { - if (VIR_ALLOC(def->disks[i]) < 0) { + virDomainDiskDefPtr disk = virDomainDiskDefNew(); + if (!disk) { error = true; break; } + def->disks[i] = disk; } } else { error = true; @@ -7175,6 +7177,10 @@ int vboxSnapshotGetReadWriteDisks(virDomainSnapshotDefPtr def, /* Allocate mem, if fails return error */ if (VIR_ALLOC_N(def->disks, def->ndisks) < 0) goto cleanup; + for (i = 0; i < def->ndisks; i++) { + if (VIR_ALLOC(def->disks[i].src) < 0) + goto cleanup; + } if (!vboxGetMaxPortSlotValues(data->vboxObj, maxPortPerInst, maxSlotPerPort)) goto cleanup; @@ -7302,11 +7308,11 @@ int vboxSnapshotGetReadWriteDisks(virDomainSnapshotDefPtr def, ret = 0; cleanup: if (ret < 0) { - for (i = 0; i < def->dom->ndisks; i++) - VIR_FREE(def->dom->disks[i]); - VIR_FREE(def->dom->disks); - def->dom->ndisks = 0; - ret = -1; + for (i = 0; i < def->ndisks; i++) { + VIR_FREE(def->disks[i].src); + } + VIR_FREE(def->disks); + def->ndisks = 0; } VBOX_RELEASE(snap); return ret; @@ -7380,8 +7386,10 @@ int vboxSnapshotGetReadOnlyDisks(virDomainSnapshotPtr snapshot, /* Allocate mem, if fails return error */ if (VIR_ALLOC_N(def->dom->disks, def->dom->ndisks) >= 0) { for (i = 0; i < def->dom->ndisks; i++) { - if (VIR_ALLOC(def->dom->disks[i]) < 0) + virDomainDiskDefPtr diskDef = virDomainDiskDefNew(); + if (!diskDef) goto cleanup; + def->dom->disks[i] = diskDef; } } else { goto cleanup; @@ -7516,7 +7524,7 @@ int vboxSnapshotGetReadOnlyDisks(virDomainSnapshotPtr snapshot, cleanup: if (ret < 0) { for (i = 0; i < def->dom->ndisks; i++) - VIR_FREE(def->dom->disks[i]); + virDomainDiskDefFree(def->dom->disks[i]); VIR_FREE(def->dom->disks); def->dom->ndisks = 0; } -- 1.7.10.4