On Fri, Nov 04, 2011 at 17:08:06 +0800, Daniel Veillard wrote:
On Fri, Nov 04, 2011 at 09:33:24AM +0100, Jiri Denemark wrote:
> This causes libvirtd to crash when both <boot dev='...'/> and
<boot
> order='...'/> are used in one domain XML. Introduced by
> 5fa3d775a9f8cdb3423373eb084219aaf778df11
> ---
> src/conf/domain_conf.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
> index 238edfd..a85f837 100644
> --- a/src/conf/domain_conf.c
> +++ b/src/conf/domain_conf.c
> @@ -6430,7 +6430,8 @@ virDomainDefParseBootXML(xmlXPathContextPtr ctxt,
> {
> xmlNodePtr *nodes = NULL;
> int i, n;
> - char *bootstr, *useserial;
> + char *bootstr;
> + char *useserial = NULL;
> int ret = -1;
> unsigned long deviceBoot, serialPorts;
Actually any input forcing us to go to cleanup before it's init
would lead to the crash, I count 5 cases :-\
Right, I didn't check how many paths can lead to freeing this uninitialized
pointer since even one path is enough to be a real problem :-)
thanks for spotting this, confirmation again what while cleaning
Coverity large set one always reintroduce some errors back, good
thing that one is trivial to fix :-) !
ACK
Thanks and pushed.
Jirka