From: Daniel P. Berrange <berrange@redhat.com>
Date: Tue, 24 Sep 2013 15:45:09 +0000 (+0100)
Subject: Fix crash on OOM in xenParseXM handling consoles
X-Git-Tag: v1.1.3-rc1~28
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=10b7d19fdd2a815cc68cf247f1bc555902b9908c;p=thirdparty%2Flibvirt.git

Fix crash on OOM in xenParseXM handling consoles

The xenParseXM sets def->nconsoles to 1 before claling
VIR_REALLOC_N on def->consoles. So if the alloc fails
due to OOM, the cleanup code will crash accessing a
console that does not exist.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---

diff --git a/src/xenxs/xen_xm.c b/src/xenxs/xen_xm.c
index 4386fefa67..1652fff798 100644
--- a/src/xenxs/xen_xm.c
+++ b/src/xenxs/xen_xm.c
@@ -1112,9 +1112,9 @@ xenParseXM(virConfPtr conf, int xendConfigVersion,
             }
         }
     } else {
-        def->nconsoles = 1;
         if (VIR_ALLOC_N(def->consoles, 1) < 0)
             goto cleanup;
+        def->nconsoles = 1;
         if (!(def->consoles[0] = xenParseSxprChar("pty", NULL)))
             goto cleanup;
         def->consoles[0]->deviceType = VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE;