After 457ff97fa there are two defects in our code. In both of
them we use a signed variable to hold up a number of snapshots
that domain has. We use a helper function to count the number.
However, the helper function may fail in which case it returns
a negative one and control jumps to cleanup label where an
unsigned variable is used to iterate over array of snapshots. The
loop condition thus compare signed and unsigned variables which
in this specific case ends up badly for us.
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
src/vbox/vbox_common.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/src/vbox/vbox_common.c b/src/vbox/vbox_common.c
index 5302d1c..8c00a4f 100644
--- a/src/vbox/vbox_common.c
+++ b/src/vbox/vbox_common.c
@@ -5507,11 +5507,10 @@ vboxDomainSnapshotGet(vboxGlobalData *data,
ISnapshot **snapshots = NULL;
ISnapshot *snapshot = NULL;
nsresult rc;
- int count = 0;
- size_t i;
+ ssize_t i, count = 0;
if ((count = vboxDomainSnapshotGetAll(dom, machine, &snapshots)) < 0)
- goto cleanup;
+ return NULL;
for (i = 0; i < count; i++) {
PRUnichar *nameUtf16;
@@ -6188,8 +6187,7 @@ static int vboxDomainSnapshotListNames(virDomainPtr dom, char
**names,
IMachine *machine = NULL;
nsresult rc;
ISnapshot **snapshots = NULL;
- int count = 0;
- size_t i;
+ ssize_t i, count = 0;
int ret = -1;
if (!data->vboxObj)
--
2.4.10