If something goes wrong in testDomainGetDiskErrors() then we try to free any strings that were previously allocated in return array. Problem is, in my review of original patch (89320788ac4) I've mistakenly did some changes which result in possible NULL dereference (@vm is set to NULL as the first thing under cleanup label). Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com&gt; --- src/test/test_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index a4c17ef0df..cfa739ecca 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -3058,7 +3058,7 @@ static int testDomainGetDiskErrors(virDomainPtr dom, virCheckFlags(0, -1); if (!(vm = testDomObjFromDomain(dom))) - goto cleanup; + return -1; if (virDomainObjCheckActive(vm) < 0) goto cleanup; @@ -3075,11 +3075,11 @@ static int testDomainGetDiskErrors(virDomainPtr dom, } cleanup: - virDomainObjEndAPI(&vm); if (ret < 0) { for (i = 0; i < MIN(vm->def->ndisks, maxerrors); i++) VIR_FREE(errors[i].disk); } + virDomainObjEndAPI(&vm); return ret; } -- 2.21.0

In my review of 89320788ac4 I've simplified assigning disk errors too much as the code I've changed it to will set VIR_DOMAIN_DISK_ERROR_NONE. This is in contradiction with our documentation which specifies that disks with no errors are not reported. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com&gt; --- src/test/test_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index cfa739ecca..ad89663de2 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -3067,7 +3067,7 @@ static int testDomainGetDiskErrors(virDomainPtr dom, for (i = 0; i < MIN(vm->def->ndisks, maxerrors); i++) { if (VIR_STRDUP(errors[i].disk, vm->def->disks[i]->dst) < 0) goto cleanup; - errors[i].error = i % VIR_DOMAIN_DISK_ERROR_LAST; + errors[i].error = (i % (VIR_DOMAIN_DISK_ERROR_LAST - 1)) + 1; } ret = i; } else { -- 2.21.0