For some reason, we allow a bridge name with %d in it, which we replace with an unsigned integer to form a bridge name that does not yet exist on the host. Do not blindly pass it to virAsprintf if it's not the only conversion, to prevent crashing on input like: <network> <name>test</name> <forward mode='none'/> <bridge name='virbr%d%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s'/> </network> Ignore any template strings that do not have exactly one %d conversion, like we do in various drivers before calling virNetDevTapCreateInBridgePort. --- This was added by commit 4c3f3b4 http://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=4c3f3b4 https://www.redhat.com/archives/libvir-list/2009-April/msg00394.html claiming it worked some time before that src/network/bridge_driver.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 3b879cd..1c5613a 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -2775,7 +2775,13 @@ networkFindUnusedBridgeName(virNetworkObjListPtr nets, int ret = -1, id = 0; char *newname = NULL; - const char *templ = def->bridge ? def->bridge : "virbr%d"; + const char *templ = "virbr%d"; + const char *p; + + if (def->bridge && + (p = strchr(def->bridge, '%')) == strrchr(def->bridge, '%') && + strstr(def->bridge, "%d")) + templ = def->bridge; do { if (virAsprintf(&newname, templ, id) < 0) @@ -2809,7 +2815,7 @@ networkFindUnusedBridgeName(virNetworkObjListPtr nets, /* * networkValidateBridgeName() - if no bridge name is set, or if the - * bridge name contains a %d (indicating that this is a template for + * bridge name contains a % (indicating that this is a template for * the actual name) try to set an appropriate bridge name. If a * bridge name *is* set, make sure it doesn't conflict with any other * network's bridge name. @@ -2820,7 +2826,7 @@ networkBridgeNameValidate(virNetworkObjListPtr nets, { int ret = -1; - if (def->bridge && !strstr(def->bridge, "%d")) { + if (def->bridge && !strchr(def->bridge, '%')) { if (virNetworkBridgeInUse(nets, def->bridge, def->name)) { virReportError(VIR_ERR_INTERNAL_ERROR, _("bridge name '%s' already in use."), -- 2.0.5