提交 ba19783d 编写于 作者: D Daniel P. Berrange

Fix crash on OOM in qemuDomainCCWAddressSetCreate()

If OOM occurs in qemuDomainCCWAddressSetCreate, it jumps to
a cleanup block and frees the partially initialized object.
It then mistakenly returns the address of the just free'd
pointer instead of NULL.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
上级 f27490b7
...@@ -1261,10 +1261,10 @@ qemuDomainCCWAddressSetCreate(void) ...@@ -1261,10 +1261,10 @@ qemuDomainCCWAddressSetCreate(void)
qemuDomainCCWAddressSetPtr addrs = NULL; qemuDomainCCWAddressSetPtr addrs = NULL;
if (VIR_ALLOC(addrs) < 0) if (VIR_ALLOC(addrs) < 0)
goto cleanup; goto error;
if (!(addrs->defined = virHashCreate(10, qemuDomainCCWAddressSetFreeEntry))) if (!(addrs->defined = virHashCreate(10, qemuDomainCCWAddressSetFreeEntry)))
goto cleanup; goto error;
/* must use cssid = 0xfe (254) for virtio-ccw devices */ /* must use cssid = 0xfe (254) for virtio-ccw devices */
addrs->next.cssid = 254; addrs->next.cssid = 254;
...@@ -1273,9 +1273,9 @@ qemuDomainCCWAddressSetCreate(void) ...@@ -1273,9 +1273,9 @@ qemuDomainCCWAddressSetCreate(void)
addrs->next.assigned = 0; addrs->next.assigned = 0;
return addrs; return addrs;
cleanup: error:
qemuDomainCCWAddressSetFree(addrs); qemuDomainCCWAddressSetFree(addrs);
return addrs; return NULL;
} }
/* /*
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册