提交 f32ea993 编写于 作者: J Ján Tomko

Set the number of elements 0 in virNetwork*Clear

Decrementing it when it was already 0 causes an invalid free
in virNetworkDefUpdateDNSHost if virNetworkDNSHostDefParseXML
fails and virNetworkDNSHostDefClear gets called twice.

virNetworkForwardDefClear left the number untouched even if it
freed all the elements.
(cherry picked from commit c4e23388)
上级 80fffee9
...@@ -134,8 +134,8 @@ virNetworkIpDefClear(virNetworkIpDefPtr def) ...@@ -134,8 +134,8 @@ virNetworkIpDefClear(virNetworkIpDefPtr def)
VIR_FREE(def->family); VIR_FREE(def->family);
VIR_FREE(def->ranges); VIR_FREE(def->ranges);
while (def->nhosts--) while (def->nhosts)
virNetworkDHCPHostDefClear(&def->hosts[def->nhosts]); virNetworkDHCPHostDefClear(&def->hosts[--def->nhosts]);
VIR_FREE(def->hosts); VIR_FREE(def->hosts);
VIR_FREE(def->tftproot); VIR_FREE(def->tftproot);
...@@ -152,8 +152,8 @@ virNetworkDNSTxtDefClear(virNetworkDNSTxtDefPtr def) ...@@ -152,8 +152,8 @@ virNetworkDNSTxtDefClear(virNetworkDNSTxtDefPtr def)
static void static void
virNetworkDNSHostDefClear(virNetworkDNSHostDefPtr def) virNetworkDNSHostDefClear(virNetworkDNSHostDefPtr def)
{ {
while (def->nnames--) while (def->nnames)
VIR_FREE(def->names[def->nnames]); VIR_FREE(def->names[--def->nnames]);
VIR_FREE(def->names); VIR_FREE(def->names);
} }
...@@ -170,18 +170,18 @@ static void ...@@ -170,18 +170,18 @@ static void
virNetworkDNSDefClear(virNetworkDNSDefPtr def) virNetworkDNSDefClear(virNetworkDNSDefPtr def)
{ {
if (def->txts) { if (def->txts) {
while (def->ntxts--) while (def->ntxts)
virNetworkDNSTxtDefClear(&def->txts[def->ntxts]); virNetworkDNSTxtDefClear(&def->txts[--def->ntxts]);
VIR_FREE(def->txts); VIR_FREE(def->txts);
} }
if (def->hosts) { if (def->hosts) {
while (def->nhosts--) while (def->nhosts)
virNetworkDNSHostDefClear(&def->hosts[def->nhosts]); virNetworkDNSHostDefClear(&def->hosts[--def->nhosts]);
VIR_FREE(def->hosts); VIR_FREE(def->hosts);
} }
if (def->srvs) { if (def->srvs) {
while (def->nsrvs--) while (def->nsrvs)
virNetworkDNSSrvDefClear(&def->srvs[def->nsrvs]); virNetworkDNSSrvDefClear(&def->srvs[--def->nsrvs]);
VIR_FREE(def->srvs); VIR_FREE(def->srvs);
} }
} }
...@@ -200,6 +200,7 @@ virNetworkForwardDefClear(virNetworkForwardDefPtr def) ...@@ -200,6 +200,7 @@ virNetworkForwardDefClear(virNetworkForwardDefPtr def)
virNetworkForwardIfDefClear(&def->ifs[ii]); virNetworkForwardIfDefClear(&def->ifs[ii]);
} }
VIR_FREE(def->ifs); VIR_FREE(def->ifs);
def->nifs = def->npfs = 0;
} }
void void
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册