virDomainGetDiskErrors uses the weird semantics where we make the caller query for the number of elements and then pass pre-allocated structure. The cleanup section errorneously used the 'count' variable to free the allocated elements for the API but 'count' can be '-1' in cases when the API returns failure, thus attempting to free beyond the end of the array. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/155 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com&gt; --- tools/virsh-domain-monitor.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tools/virsh-domain-monitor.c b/tools/virsh-domain-monitor.c index 0e49f5da8a..a2bf5c05fc 100644 --- a/tools/virsh-domain-monitor.c +++ b/tools/virsh-domain-monitor.c @@ -1220,7 +1220,7 @@ cmdDomBlkError(vshControl *ctl, const vshCmd *cmd) { virDomainPtr dom; virDomainDiskErrorPtr disks = NULL; - unsigned int ndisks; + unsigned int ndisks = 0; size_t i; int count; bool ret = false; @@ -1230,10 +1230,10 @@ cmdDomBlkError(vshControl *ctl, const vshCmd *cmd) if ((count = virDomainGetDiskErrors(dom, NULL, 0, 0)) < 0) goto cleanup; - ndisks = count; - if (ndisks) { - disks = g_new0(virDomainDiskError, ndisks); + if (count > 0) { + disks = g_new0(virDomainDiskError, count); + ndisks = count; if ((count = virDomainGetDiskErrors(dom, disks, ndisks, 0)) == -1) goto cleanup; @@ -1252,7 +1252,7 @@ cmdDomBlkError(vshControl *ctl, const vshCmd *cmd) ret = true; cleanup: - for (i = 0; i < count; i++) + for (i = 0; i < ndisks; i++) VIR_FREE(disks[i].disk); VIR_FREE(disks); virshDomainFree(dom); -- 2.30.2