From d508f70df0f400fe66ac9c94fa0b79318b73de26 Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" Date: Wed, 25 Sep 2013 09:30:20 +0100 Subject: [PATCH] Fix crash on OOM in xenParseSxpr The xenParseSxpr method sets def->nconsoles to 1 before allocating the def->consoles array. If the allocation fails due to OOM the cleanup code will thus crash accessing out of bounds. Signed-off-by: Daniel P. Berrange --- src/xenxs/xen_sxpr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/xenxs/xen_sxpr.c b/src/xenxs/xen_sxpr.c index 6209c683a6..462eac6a99 100644 --- a/src/xenxs/xen_sxpr.c +++ b/src/xenxs/xen_sxpr.c @@ -1439,9 +1439,9 @@ xenParseSxpr(const struct sexpr *root, def->parallels[def->nparallels++] = chr; } } else if (def->id != 0) { - def->nconsoles = 1; if (VIR_ALLOC_N(def->consoles, 1) < 0) goto error; + def->nconsoles = 1; /* Fake a paravirt console, since that's not in the sexpr */ if (!(def->consoles[0] = xenParseSxprChar("pty", tty))) goto error; -- GitLab