The memmove to move elements in the dhcp hosts array when inserting and deleting items was mistakenly basing the length of the copy on the size of a virNetworkDHCPHostDefPtr rather than virNetworkDHCPHostDef, with the expected disastrous results. --- We really should create a VIR_SOMETHING() macro to take care of this... src/conf/network_conf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index db398ae..046891c 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -2449,7 +2449,7 @@ virNetworkDefUpdateIPDHCPHost(virNetworkDefPtr def, } else { /* implied (command == VIR_NETWORK_UPDATE_COMMAND_ADD_FIRST) */ memmove(ipdef->hosts + 1, ipdef->hosts, - sizeof(ipdef->hosts) * ipdef->nhosts); + sizeof(*ipdef->hosts) * ipdef->nhosts); ipdef->hosts[0] = host; ipdef->nhosts++; memset(&host, 0, sizeof(host)); @@ -2481,7 +2481,7 @@ virNetworkDefUpdateIPDHCPHost(virNetworkDefPtr def, /* remove it */ virNetworkDHCPHostDefClear(&ipdef->hosts[ii]); memmove(ipdef->hosts + ii, ipdef->hosts + ii + 1, - sizeof(ipdef->hosts) * ipdef->nhosts - ii - 1); + sizeof(*ipdef->hosts) * ipdef->nhosts - ii - 1); ipdef->nhosts--; ignore_value(VIR_REALLOC_N(ipdef->hosts, ipdef->nhosts)); } -- 1.7.11.4