]> git.ipfire.org Git - thirdparty/libvirt.git/commit
bhyve: fix crash in bhyveBuildNetArgStr
authorRoman Bogorodskiy <bogorodskiy@gmail.com>
Fri, 13 Jun 2014 16:14:53 +0000 (20:14 +0400)
committerRoman Bogorodskiy <bogorodskiy@gmail.com>
Fri, 13 Jun 2014 16:44:36 +0000 (20:44 +0400)
commit381a3dbdab206e4048bab73ce2dd1c72b396814d
tree693e0d886b7c1a043d605c852172ae25cb0b9eff
parentd6e92bfa38d2d2dffa2ec38373e2922268d32b51
bhyve: fix crash in bhyveBuildNetArgStr

bhyveBuildNetArgStr() calls virNetDevTapCreateInBridgePort() and
passes tapfd = NULL, but tapfdSize = 1. That is wrong, because
if virNetDevTapCreateInBridgePort() crashes after successfully
creating a TAP device, it'll jump to 'error' label, that
loops over tapfd and calls VIR_FORCE_CLOSE:

   for (i = 0; i < tapfdSize && tapfd[i] >= 0; i++)

In that case we get a segfault.

As the bhyve code doesn't use tapfd, pass NULL and set tapfdSize to 0.
src/bhyve/bhyve_command.c