提交 d508f70d 编写于 作者: D Daniel P. Berrange

Fix crash on OOM in xenParseSxpr

The xenParseSxpr method sets def->nconsoles to 1 before allocating
the def->consoles array. If the allocation fails due to OOM the
cleanup code will thus crash accessing out of bounds.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
上级 b80fff14
......@@ -1439,9 +1439,9 @@ xenParseSxpr(const struct sexpr *root,
def->parallels[def->nparallels++] = chr;
}
} else if (def->id != 0) {
def->nconsoles = 1;
if (VIR_ALLOC_N(def->consoles, 1) < 0)
goto error;
def->nconsoles = 1;
/* Fake a paravirt console, since that's not in the sexpr */
if (!(def->consoles[0] = xenParseSxprChar("pty", tty)))
goto error;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册