提交 871e10fc 编写于 作者: J Jason J. Herne 提交者: Andrea Bolognani

Fix libvirtd free() segfault when migrating guest with deleted open vswitch port

libvirtd crashes on free()ing portData for an open vswitch port if that port
was deleted.  To reproduce:

ovs-vsctl del-port vnet0
virsh migrate --live kvm1 qemu+ssh://dstHost/system

Error message:
libvirtd: *** Error in `/usr/sbin/libvirtd': free(): invalid pointer: 0x000003ff90001e20 ***

The problem is that virCommandRun can return an empty string in the event that
the port being queried does not exist. When this happens then we are
unconditionally overwriting a newline character at position strlen()-1. When
strlen is 0, we overwrite memory that does not belong to the string.

The fix: Only overwrite the newline if the string is not empty.
Reviewed-by: NBjoern Walk <bwalk@linux.vnet.ibm.com>
Signed-off-by: NJason J. Herne <jjherne@linux.vnet.ibm.com>
上级 370608b4
......@@ -222,8 +222,10 @@ int virNetDevOpenvswitchGetMigrateData(char **migrate, const char *ifname)
goto cleanup;
}
/* Wipeout the newline */
(*migrate)[strlen(*migrate) - 1] = '\0';
/* Wipeout the newline, if it exists */
if (strlen(*migrate) > 0)
(*migrate)[strlen(*migrate) - 1] = '\0';
ret = 0;
cleanup:
virCommandFree(cmd);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册