On Sat, Jan 09, 2010 at 09:26:11PM +0100, Matthias Bolte wrote:

qemudWaitForMonitor calls qemudReadLogOutput with qemudFindCharDevicePTYs as callback. qemudFindCharDevicePTYs calls qemudExtractTTYPath to assign a string to chr->data.file.path. Afterwards qemudWaitForMonitor may call qemudFindCharDevicePTYsMonitor that overwrites chr->data.file.path without freeing the old value. This results in leaking the memory allocated by qemudExtractTTYPath.

Report an OOM error if the strdup in qemudFindCharDevicePTYsMonitor fails. --- src/qemu/qemu_driver.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index daa6f94..8817565 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -1433,7 +1433,13 @@ qemudFindCharDevicePTYsMonitor(virConnectPtr conn, return -1; \ } \ \ + VIR_FREE(chr->data.file.path); \ chr->data.file.path = strdup(path); \ + \ + if (chr->data.file.path == NULL) { \ + virReportOOMError(conn); \ + return -1; \ + } \ } \ }

--

ACK Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|