From: Peter Krempa <pkrempa@redhat.com>
Date: Wed, 4 Jul 2012 10:15:19 +0000 (+0200)
Subject: virsh: Fix ordering of arguments when calling vshCalloc.
X-Git-Tag: CVE-2012-3445~222
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3cdb3b4e648c6690fba3647da88d73f99367b8be;p=thirdparty%2Flibvirt.git

virsh: Fix ordering of arguments when calling vshCalloc.

In vshSnapshotListCollect() vshCalloc was called with swapped nmemb and
size argument. This caused division by zero in xalloc_oversized as the
macro doesn't expect size to be zero.
---

diff --git a/tools/virsh.c b/tools/virsh.c
index 53d1825cd7..85b1185887 100644
--- a/tools/virsh.c
+++ b/tools/virsh.c
@@ -17200,8 +17200,8 @@ vshSnapshotListCollect(vshControl *ctl, virDomainPtr dom,
     if (count >= 0) {
         /* When mixing --from and --tree, we also want a copy of from
          * in the list, but with no parent for that one entry.  */
-        snaplist->snaps = vshCalloc(ctl, sizeof(*snaplist->snaps),
-                                    count + (tree && from));
+        snaplist->snaps = vshCalloc(ctl, count + (tree && from),
+                                    sizeof(*snaplist->snaps));
         snaplist->nsnaps = count;
         for (i = 0; i < count; i++)
             snaplist->snaps[i].snap = snaps[i];