From: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
Date: Thu, 16 May 2013 12:41:29 +0000 (+0200)
Subject: qemu: Fix crash in migration of graphics-less guests.
X-Git-Tag: CVE-2013-1962~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9684bb11fd3832582308d0bcdb649041fd6584e2;p=thirdparty%2Flibvirt.git

qemu: Fix crash in migration of graphics-less guests.

Commit 7f15ebc7a2b599ab10dbc15bca6f823591213e67 introduced a bug
happening when guests without a <graphics> element are migrated.
The initialization of listenAddress happens unconditionally
from the cookie even if the cookie->graphics pointer was NULL.
Moved the initialization to where it is safe.

Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
---

diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
index e38d99b586..e10127db86 100644
--- a/src/qemu/qemu_migration.c
+++ b/src/qemu/qemu_migration.c
@@ -1723,7 +1723,7 @@ qemuDomainMigrateGraphicsRelocate(virQEMUDriverPtr driver,
 {
     qemuDomainObjPrivatePtr priv = vm->privateData;
     int ret;
-    char *listenAddress = cookie->graphics->listen;
+    char *listenAddress;
 
     if (!cookie)
         return 0;
@@ -1737,6 +1737,7 @@ qemuDomainMigrateGraphicsRelocate(virQEMUDriverPtr driver,
     if (cookie->graphics->type != VIR_DOMAIN_GRAPHICS_TYPE_SPICE)
         return 0;
 
+    listenAddress = cookie->graphics->listen;
     if (!listenAddress ||
         STREQ(listenAddress, "0.0.0.0") ||
         STREQ(listenAddress, "::"))