The 'nodes' is overwritten after the first usage and possibly leaked
if any code in the first set of parsing goes to error.
Found by Coverity.
Signed-off-by: John Ferlan <jferlan(a)redhat.com>
---
src/conf/node_device_conf.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/src/conf/node_device_conf.c b/src/conf/node_device_conf.c
index 1c81b48..07b0838 100644
--- a/src/conf/node_device_conf.c
+++ b/src/conf/node_device_conf.c
@@ -1766,7 +1766,7 @@ virNodeDeviceDefParseXML(xmlXPathContextPtr ctxt,
{
virNodeDeviceDefPtr def;
virNodeDevCapsDefPtr *next_cap;
- xmlNodePtr *nodes;
+ xmlNodePtr *nodes = NULL;
int n, m;
size_t i;
@@ -1789,7 +1789,6 @@ virNodeDeviceDefParseXML(xmlXPathContextPtr ctxt,
def->sysfs_path = virXPathString("string(./path[1])", ctxt);
/* Parse devnodes */
- nodes = NULL;
if ((n = virXPathNodeSet("./devnode", ctxt, &nodes)) < 0)
goto error;
@@ -1842,7 +1841,7 @@ virNodeDeviceDefParseXML(xmlXPathContextPtr ctxt,
ctxt);
/* Parse device capabilities */
- nodes = NULL;
+ VIR_FREE(nodes);
if ((n = virXPathNodeSet("./capability", ctxt, &nodes)) < 0)
goto error;
@@ -1859,10 +1858,8 @@ virNodeDeviceDefParseXML(xmlXPathContextPtr ctxt,
nodes[i],
create,
virt_type);
- if (!*next_cap) {
- VIR_FREE(nodes);
+ if (!*next_cap)
goto error;
- }
next_cap = &(*next_cap)->next;
}
@@ -1872,6 +1869,7 @@ virNodeDeviceDefParseXML(xmlXPathContextPtr ctxt,
error:
virNodeDeviceDefFree(def);
+ VIR_FREE(nodes);
return NULL;
}
--
2.9.3