If we reached cleanup: prior to allocating cpus, it was possible that 'nr_nodes' had a value, but cpus was NULL leading to a possible NULL deref. Add a 'cpus' as an end condition to for loop --- Will push based upon pre-approved ACK: https://www.redhat.com/archives/libvir-list/2013-August/msg00981.html src/libxl/libxl_conf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/libxl/libxl_conf.c b/src/libxl/libxl_conf.c index 01626b9..8129c7f 100644 --- a/src/libxl/libxl_conf.c +++ b/src/libxl/libxl_conf.c @@ -196,7 +196,7 @@ libxlCapsInitNuma(libxl_ctx *ctx, virCapsPtr caps) cleanup: if (ret != 0) { - for (i = 0; i < nr_nodes; i++) + for (i = 0; cpus && i < nr_nodes; i++) VIR_FREE(cpus[i]); virCapabilitiesFreeNUMAInfo(caps); } -- 1.8.3.1