From: Daniel P. Berrange <berrange@redhat.com>
Date: Wed, 25 Sep 2013 09:22:42 +0000 (+0100)
Subject: Fix crash on OOM parsing storage pool XML
X-Git-Tag: v1.1.3-rc1~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6b663b6fd1a5d7e80872792a762c8920d0936d32;p=thirdparty%2Flibvirt.git

Fix crash on OOM parsing storage pool XML

The virStoragePoolDefParseSource method would set def->nhosts
before allocating def->hosts. If the allocation failed due to
OOM, the cleanup code would crash accessing out of bounds.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---

diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c
index 002663f1e4..975e662641 100644
--- a/src/conf/storage_conf.c
+++ b/src/conf/storage_conf.c
@@ -594,11 +594,11 @@ virStoragePoolDefParseSource(xmlXPathContextPtr ctxt,
 
     if ((n = virXPathNodeSet("./host", ctxt, &nodeset)) < 0)
         goto cleanup;
-    source->nhost = n;
 
-    if (source->nhost) {
-        if (VIR_ALLOC_N(source->hosts, source->nhost) < 0)
+    if (n) {
+        if (VIR_ALLOC_N(source->hosts, n) < 0)
             goto cleanup;
+        source->nhost = n;
 
         for (i = 0; i < source->nhost; i++) {
             name = virXMLPropString(nodeset[i], "name");