domain_conf: fix possible memory leak

Until now, it was possible to crash libvirtd when defining domain with
channel device with missing source element.

When creating new virDomainChrDef, target.port is set to -1, but
unfortunately it is an union with addresses that virDomainChrDefFree
tries to free in case the deviceType is channel. Having the port set
to -1 is intended, however the cleanest way to get around the problems
with the crash seems to be renumbering the VIR_DOMAIN_CHR_CHANNEL_
target types to cover new NONE type (with value 0) being the default
(no target type yet).
(cherry picked from commit 830d035ff5a88c3896a6e508364e34697de941a1)

diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index d886b60a84c948ff5f25debbb8f4db18336c50ca..95d0c3abc6a8f6c657941fcddf7b5054a9230887 100644 (file)
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -307,6 +307,7 @@ VIR_ENUM_IMPL(virDomainNetInterfaceLinkState, VIR_DOMAIN_NET_INTERFACE_LINK_STAT
 
 VIR_ENUM_IMPL(virDomainChrChannelTarget,
               VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_LAST,
+              "none",
               "guestfwd",
               "virtio")
 

diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index 1b8741e211428b3407e562b3fe2c33d669c7b13a..1e40968965c075daa8474fa75464f4482140309e 100644 (file)
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -846,7 +846,8 @@ enum virDomainChrDeviceType {
 };
 
 enum virDomainChrChannelTargetType {
-    VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_GUESTFWD = 0,
+    VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_NONE = 0,
+    VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_GUESTFWD,
     VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_VIRTIO,
 
     VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_LAST,