From: Ján Tomko <jtomko@redhat.com>
Date: Wed, 28 Nov 2012 13:34:51 +0000 (+0100)
Subject: conf: snapshot: check return value of virDomainSnapshotObjListNum
X-Git-Tag: CVE-2012-3411~27
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0361917619963d4bc6e9c8215368beaab9db2c5f;p=thirdparty%2Flibvirt.git

conf: snapshot: check return value of virDomainSnapshotObjListNum

If it's negative, this might result in a request to allocate lots of
memory.
---

diff --git a/src/conf/snapshot_conf.c b/src/conf/snapshot_conf.c
index 72bdd30221..06be34d926 100644
--- a/src/conf/snapshot_conf.c
+++ b/src/conf/snapshot_conf.c
@@ -1026,7 +1026,7 @@ virDomainListSnapshots(virDomainSnapshotObjListPtr snapshots,
     int ret = -1;
     int i;
 
-    if (!snaps)
+    if (!snaps || count < 0)
         return count;
     if (VIR_ALLOC_N(names, count) < 0 ||
         VIR_ALLOC_N(list, count + 1) < 0) {