1. 29 8月, 2013 7 次提交
    • D
      Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292) · fd6f6a48
      Daniel P. Berrange 提交于
      The parameters for the virDomainMigrate*Params RPC calls were
      not bounds checks, meaning a malicious client can cause libvirtd
      to consume arbitrary memory
      
      This issue was introduced in the 1.1.0 release of libvirt
      Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
      fd6f6a48
    • G
      python: Fix a PyList usage mistake · c2618149
      Guan Qiang 提交于
      Fix PyList usage mistake in Function libvirt_lxc_virDomainLxcOpenNamespace.
      
      https://bugzilla.redhat.com/show_bug.cgi?id=1002383Signed-off-by: NEric Blake <eblake@redhat.com>
      c2618149
    • M
      autogen.sh: Correctly detect .git as a file · 834a86ea
      Michal Privoznik 提交于
      One of my previous patches 5cfe0d37 tried to handle the case when
      libvirt is a submodule of another project. In that case, the .git is
      just a link to the parent .git directory (which the autogen.sh script
      didn't count on). The fix was missing 'test' though.
      834a86ea
    • M
      bridge_driver: Introduce networkObjFromNetwork · 0f396366
      Michal Privoznik 提交于
      Similarly to qemu_driver.c, we can join often repeating code of looking
      up network into one function: networkObjFromNetwork.
      Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
      0f396366
    • P
      14da45c8
    • P
      qemu: Remove hostdev entry when freeing the depending network entry · 50348e6e
      Peter Krempa 提交于
      When using a <interface type="network"> that points to a network with
      hostdev forwarding mode a hostdev alias is created for the network. This
      allias is inserted into the hostdev list, but is backed with a part of
      the network object that it is connected to.
      
      When a VM is being stopped qemuProcessStop() calls
      networkReleaseActualDevice() which eventually frees the memory for the
      hostdev object. Afterwards when the domain definition is being freed by
      virDomainDefFree() an invalid pointer is accessed by
      virDomainHostdevDefFree() and may cause a crash of the daemon.
      
      This patch removes the entry in the hostdev list before freeing the
      depending memory to avoid this issue.
      
      Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1000973
      50348e6e
    • E
      virsh: detect programming errors with option parsing · 8aecd351
      Eric Blake 提交于
      Noticed while reviewing another patch that had an accidental
      mismatch due to refactoring.  An audit of the code showed that
      very few callers of vshCommandOpt were expecting a return of
      -2, indicating programmer error, and of those that DID check,
      they just propagated that status to yet another caller that
      did not check.  Fix this by making the code blatantly warn
      the programmer, rather than silently ignoring it and possibly
      doing the wrong thing downstream.
      
      I know that we frown on assert()/abort() inside libvirtd
      (libraries should NEVER kill the program that linked them),
      but as virsh is an app rather than the library, and as this
      is not the first use of assert() in virsh, I think this
      approach is okay.
      
      * tools/virsh.h (vshCommandOpt): Drop declaration.
      * tools/virsh.c (vshCommandOpt): Make static, and add a
      parameter.  Abort on programmer errors rather than making callers
      repeat that logic.
      (vshCommandOptInt, vshCommandOptUInt, vshCommandOptUL)
      (vshCommandOptString, vshCommandOptStringReq)
      (vshCommandOptLongLong, vshCommandOptULongLong)
      (vshCommandOptBool): Adjust callers.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      8aecd351
  2. 28 8月, 2013 9 次提交
    • J
      virt-sanlock-cleanup; Fix augtool usage · 74c5156f
      Jiri Denemark 提交于
      Surprisingly, augtool get (or print) returns "path = value" while we are
      only interested in the value. We need to remove the "path = " part from
      the augtool's output. The following is an example of the augtool command
      as used in virt-sanlock-cleanup script:
      
      $ augtool get /files/etc/libvirt/qemu-sanlock.conf/disk_lease_dir
      /files/etc/libvirt/qemu-sanlock.conf/disk_lease_dir = /var/lib/libvirt/sanlock
      74c5156f
    • M
      virsh: Fix debugging · ac43da70
      Martin Kletzander 提交于
      Commit a0b6a36f "fixed" what abfff210 broke (URI precedence), but
      there was still one more thing missing to fix.  When using virsh
      parameters to setup debugging, those weren't honored, because at the
      time debugging was initializing, arguments weren't parsed yet.  To
      make ewerything work as expected, we need to initialize the debugging
      twice, once before debugging (so we can debug option parsing properly)
      and then again after these options are parsed.
      
      As a side effect, this patch also fixes a leak when virsh is ran with
      multiple '-l' parameters.
      Signed-off-by: NMartin Kletzander <mkletzan@redhat.com>
      ac43da70
    • M
      virsh-pool.c: Don't jump over variable declaration · 2ab0948d
      Michal Privoznik 提交于
      Since 785ff34b we are using the outputStr variable in cleanup label.
      However, there is a possibility to jump to the label before the variable
      has been declared:
      
      virsh-pool.c: In function 'cmdPoolList':
      virsh-pool.c:1121:25: error: jump skips variable initialization [-Werror=jump-misses-init]
                               goto asprintf_failure;
                               ^
      virsh-pool.c:1308:1: note: label 'asprintf_failure' defined here
       asprintf_failure:
       ^
      virsh-pool.c:1267:11: note: 'outputStr' declared here
           char *outputStr = NULL;
      2ab0948d
    • J
      virsh: free the caps list properly if one of them is invalid · 14d53286
      Ján Tomko 提交于
      VIR_FREE(caps) is not enough to free an array allocated
      by vshStringToArray.
      
      ==17== 4 bytes in 1 blocks are definitely lost in loss record 4 of 728
      ==17==    by 0x4EFFC44: virStrdup (virstring.c:554)
      ==17==    by 0x128B10: _vshStrdup (virsh.c:125)
      ==17==    by 0x129164: vshStringToArray (virsh.c:218)
      ==17==    by 0x157BB3: cmdNodeListDevices (virsh-nodedev.c:409)
      
      https://bugzilla.redhat.com/show_bug.cgi?id=1001536
      14d53286
    • J
      virsh: free the formatting string when listing pool details · 785ff34b
      Ján Tomko 提交于
      ==23== 41 bytes in 1 blocks are definitely lost in loss record 626 of 727
      ==23==    by 0x4F0099F: virAsprintfInternal (virstring.c:358)
      ==23==    by 0x15D2C9: cmdPoolList (virsh-pool.c:1268)
      
      https://bugzilla.redhat.com/show_bug.cgi?id=1001536
      785ff34b
    • J
      virsh: free the list from ListAll APIs even for 0 items · f733eac0
      Ján Tomko 提交于
      virsh secret-list leak when no secrets are defined:
      
      ==27== 8 bytes in 1 blocks are definitely lost in loss record 6 of 726
      ==27==    by 0x4E941DD: virAllocN (viralloc.c:183)
      ==27==    by 0x5037F1A: remoteConnectListAllSecrets (remote_driver.c:3076)
      ==27==    by 0x5004EC6: virConnectListAllSecrets (libvirt.c:16298)
      ==27==    by 0x15F813: vshSecretListCollect (virsh-secret.c:397)
      ==27==    by 0x15F0E1: cmdSecretList (virsh-secret.c:532)
      
      And so do some other *-list commands.
      
      https://bugzilla.redhat.com/show_bug.cgi?id=1001536
      f733eac0
    • J
      virsh: free messages after logging them to a file · 66d124b4
      Ján Tomko 提交于
      The messages were only freed on error.
      
      ==12== 1,100 bytes in 1 blocks are definitely lost in loss record 698 of 729
      ==12==    by 0x4E98C22: virBufferAsprintf (virbuffer.c:294)
      ==12==    by 0x12C950: vshOutputLogFile (virsh.c:2440)
      ==12==    by 0x12880B: vshError (virsh.c:2254)
      ==12==    by 0x131957: vshCommandOptDomainBy (virsh-domain.c:109)
      ==12==    by 0x14253E: cmdStart (virsh-domain.c:3333)
      
      https://bugzilla.redhat.com/show_bug.cgi?id=1001536
      66d124b4
    • J
      Test network update XML parsing · 2d9185a9
      Ján Tomko 提交于
      Add checks for updating sections of network definition via
      virNetworkDefUpdateSection.
      
      https://bugzilla.redhat.com/show_bug.cgi?id=989569
      2d9185a9
    • J
      Remove the space before the slash in network XML · d8bd24a9
      Ján Tomko 提交于
      This matches the style we use elsewhere and allows
      nat-network-dns-srv-record{,-minimal}.xml to be tested in
      network XML -> XML test.
      d8bd24a9
  3. 27 8月, 2013 9 次提交
  4. 26 8月, 2013 15 次提交