diff --git a/ChangeLog b/ChangeLog
index 2e4ab0dd77928e3b718d8f0c3f59da5776482617..d514d9cfbfc133d6de61e8ad05f1b223a9e22302 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+Mon Feb 26 14:20:18 IST 2007 Mark McLoughlin <markmc@redhat.com>
+
+	* qemud/conf.c: check for malloc failure in GenerateXML()
+	and GenerateNetworkXML()
+
+	* qemud/driver.c: free the XML output after returning it
+	from the DumpXML() commands.
+	
 Fri Feb 23 12:14:34 EST 2007 Daniel P. Berrange <berrange@redhat.com>
 
 	* qemud/driver.c, qemud/internal.h, qemud/qemud.c, qemud/conf.c,
diff --git a/qemud/conf.c b/qemud/conf.c
index 54d67f430d21718c95a7c6c20c557d9ac7681fbe..83ae003ee8bae58b1af5d963f0e030b8bbba1410 100644
--- a/qemud/conf.c
+++ b/qemud/conf.c
@@ -2216,6 +2216,9 @@ char *qemudGenerateXML(struct qemud_server *server,
     buf.used = 0;
     buf.data = malloc(buf.len);
 
+    if (!buf.data)
+        goto no_memory;
+
     switch (def->virtType) {
     case QEMUD_VIRT_QEMU:
         type = "qemu";
@@ -2432,7 +2435,8 @@ char *qemudGenerateXML(struct qemud_server *server,
  no_memory:
     qemudReportError(server, VIR_ERR_NO_MEMORY, "xml");
  cleanup:
-    free(buf.data);
+    if (buf.data)
+        free(buf.data);
     return NULL;
 }
 
@@ -2447,6 +2451,9 @@ char *qemudGenerateNetworkXML(struct qemud_server *server,
     buf.used = 0;
     buf.data = malloc(buf.len);
 
+    if (!buf.data)
+        goto no_memory;
+
     if (qemudBufferPrintf(&buf, "<network>\n") < 0)
         goto no_memory;
 
@@ -2508,7 +2515,8 @@ char *qemudGenerateNetworkXML(struct qemud_server *server,
 
  no_memory:
     qemudReportError(server, VIR_ERR_NO_MEMORY, "xml");
-    free(buf.data);
+    if (buf.data)
+        free(buf.data);
     return NULL;
 }
 
diff --git a/qemud/driver.c b/qemud/driver.c
index 6074aa5236fe4f717fa7fafaf9ef4dcc36719a73..24c1e9ecf8c61378e788b955e6f7a8b51fc8f9c4 100644
--- a/qemud/driver.c
+++ b/qemud/driver.c
@@ -432,6 +432,8 @@ int qemudDomainDumpXML(struct qemud_server *server, const unsigned char *uuid, c
     strncpy(xml, vmxml, xmllen);
     xml[xmllen-1] = '\0';
 
+    free(xml);
+
     return 0;
 }
 
@@ -741,6 +743,8 @@ int qemudNetworkDumpXML(struct qemud_server *server, const unsigned char *uuid,
     strncpy(xml, networkxml, xmllen);
     xml[xmllen-1] = '\0';
 
+    free(xml);
+
     return 0;
 }