Fix crash on OOM parsing storage pool XML

The virStoragePoolDefParseSource method would set def->nhosts
before allocating def->hosts. If the allocation failed due to
OOM, the cleanup code would crash accessing out of bounds.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c
index 002663f1e4e3f92aecbec8b5099e2d8ec81dc4d8..975e66264135612d61bc04e538abe6388c3688e1 100644 (file)
--- a/src/conf/storage_conf.c
+++ b/src/conf/storage_conf.c
@@ -594,11 +594,11 @@ virStoragePoolDefParseSource(xmlXPathContextPtr ctxt,
 
     if ((n = virXPathNodeSet("./host", ctxt, &nodeset)) < 0)
         goto cleanup;
-    source->nhost = n;
 
-    if (source->nhost) {
-        if (VIR_ALLOC_N(source->hosts, source->nhost) < 0)
+    if (n) {
+        if (VIR_ALLOC_N(source->hosts, n) < 0)
             goto cleanup;
+        source->nhost = n;
 
         for (i = 0; i < source->nhost; i++) {
             name = virXMLPropString(nodeset[i], "name");