Since commit 297c99a5 an invalid source definition XML of a character
device that is used as backend for RNG devices, smartcards and redirdevs
causes crash of the daemon when parsing such a definition.

The device types mentioned above are not a part of a regular character
device but are backends for other types. Thus when parsing such device
NULL is passed as the argument @chr_def. Later when checking the
validity of the definition @chr_def was dereferenced when parsing a UNIX
socket backend with missing path of the socket and crashed the daemon.

Sample offending configuration:
  <devices>
  ...
    <rng model='virtio'>
      <backend model='egd' type='unix'>
        <source mode='bind' service='1024'/>
      </backend>
    </rng>
  </devices>

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1012196

- Move COPYING* to libvirt-client, so every package pulls them in
- Move AUTHORS ChangeLog.gz NEWS README TODO from -daemon to -docs
- Drop duplicate distribution of docs in -python

https://bugzilla.redhat.com/show_bug.cgi?id=977099

When passing in custom driver XML, allow a block like

<domain xmlns:test='http://libvirt.org/schemas/domain/test/1.0'>
  ...
  <test:runstate>5</test:runstate>
</domain>

This is only read at initial driver start time, and sets the initial
run state of the object. This is handy for UI testing.

It's only wired up for domains, since that's the only conf/
infrastructure that supports namespaces at the moment.

If an error occurs in virnetmessagetest it was possible it
would free uninitialized data.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virnetmessagetest code did not check for failure to
allocate the message object. This lead to a crash on OOM
in the test suite.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virportallocatortest did not check if the object
allocation failed in all cases. This lead to a crash
on OOM in the testsuite
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virlockspacetest.c did not check for failure to create
a lockspace, causing a crash on OOM
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virbuftest code did not check virBufferError before
accessing the buffer contents, resulting in a crash on
OOM conditions.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virDomainChrSourceDef variable should be memset to
0, so that the cleanup block does not free uninitialized
data on OOM.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The qemuMonitorCommonTestInit method did not allocate the
test object, so it should not free it upon failure. Doing
so causes a double free with the caller.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Don't leak the path string in qemuMonitorCommonTestNew if
an OOM occurs.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

For inexplicable reasons, the nwfilter XML parser is intentionally
ignoring errors that arise during parsing. As well as meaning that
users don't get any feedback on their XML mistakes, this will lead
it to silently drop data in OOM conditions.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Normally a lockspace resource is not freed while there are
active owners. During initial resource creation though, an
OOM error will trigger this scenario. virLockSpaceResourceFree
was not freeing the 'owners' field in this case.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If OOM or another error occurs in virJSONValueFromString the
parser state object will be leaked.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If OOM occurs in virJSONParserHandleStartMap it will free
a variable that is owned by another object. This leads to
a later double-free.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If virDBusMessageIterEncode hits an OOM condition it often
leaks the memory associated with the dbus iterator object
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The vmx2xmltest test would print all errors to stderr, which
is not helpful when running OOM tests, and differs from the
behaviour of other tests.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The code parsing comments in config files called virConfAddEntry
but did not check for failure. This caused the comment string to
leak on OOM.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virVMXFormatConfig called virVMXEscapeHexPipe but
forgot to check for OOM. This caused data to silently
be lost.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virStoragePoolDefParseSource method would set def->nhosts
before allocating def->hosts. If the allocation failed due to
OOM, the cleanup code would crash accessing out of bounds.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If xenParseSxprPCI failed to expand the def->hostdevs array
due to OOM, it would free the hostdev instance twice.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The testCompareXMLToXMLHelper method clobbered the 'ret' variable
in several places leading to a failure to report OOM errors from
the test suite.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virDomainSnapshotDefParse method assigned to def->ndisks
before allocating def->disks. Thus if an OOM occurred, the
cleanup code would access out of bounds.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Several places in virInterfaceDefParseProtoIPv6 clobber the
default 'ret' return value. So when jumping to cleanup on
error, 'ret' may mistakenly be set to 0 instead of -1. This
caused failure to report OOM errors, meaning data was silently
lost during parsing.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The methods for obtaining the Xen dom ID cannot distinguish
between returning -1 due to an error and returning -1 due to
the domain being shutoff. Change them to return the dom ID
via an output parameter.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The xenParseSxpr method sets def->nconsoles to 1 before allocating
the def->consoles array. If the allocation fails due to OOM the
cleanup code will thus crash accessing out of bounds.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Signed-off-by: NEric Blake <eblake@redhat.com>

If an OOM occurs in xenFormatXM when formatting to the
serial device value, the value is leaked.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If an OOM occurs when xenFormatXM is setting the 'hpet'
variable it is silently ignored. Fix it to propagate
to the callers.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The xenParseXM sets def->nconsoles to 1 before claling
VIR_REALLOC_N on def->consoles. So if the alloc fails
due to OOM, the cleanup code will crash accessing a
console that does not exist.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If an OOM occurs in xenParseXM, a virDomainChrDef may be
leaked.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If qemuParseCommandLine finds an arg it does not understand
it adds it to the QEMU passthrough custom arg list. If the
qemuParseCommandLine method hits an error for any reason
though, it just does 'VIR_FREE(cmd)' on the custom arg list.
This means all actual args / env vars are leaked. Introduce
a qemuDomainCmdlineDefFree method to be used for cleanup.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If the call to virDomainControllerInsert fails in
qemuParseCommandLine, the controller struct is leaked.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The 'qemuStringToArgvEnv' method splits up a string of command
line env/args to an 'arglist' array. It then copies env vars
to a 'progenv' array and args to a 'progargv' array. When
copyin the env vars, it NULL-ifies the element in 'arglist'
that is copied.

Upon OOM the 'virStringListFree' is called on progenv and
arglist. Unfortunately, because the elements in 'arglist'
related to env vars have been set to NULL, the call to
virStringListFree(arglist) doesn't free anything, even
though some non-NULL args vars still exist later in the
array.

To fix this leak, stop NULL-ifying the 'arglist' elements,
and change the cleanup code to only free elements in the
'arglist' array, not 'progenv'.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

In a number of places in qemuParseCommandLineDisk, an error
is reported, but no 'goto error' jump is used. This causes
failure to report OOM conditions to the caller.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If OOM occurs in qemuParseCommandLineDisk some intermediate
variables will be leaked when parsing Sheepdog or RBD disks.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The qemuBuildCommandLine code for parsing sound cards will leak
an intermediate variable if an OOM occurs. Move the free'ing of
the variable earlier to avoid the leak.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

In qemuParseNBDString, if the virURIParse fails, the
error is not reported to the caller. Instead execution
falls through to the non-URI codepath causing memory
leaks later on.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If qemuAddRBDHost fails due to parsing problems or OOM, then
qemuParseRBDString cleanup is skipped causing a memory leak.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

qemuDomainPCIAddressGetNextSlot has a loop for finding
compatible PCI buses. In the loop body it creates a
PCI address string, but never frees this. This causes
a leak if the loop executes more than one iteration,
or if a call in the loop body fails.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>