From: Marc Hartmayer <mhartmay@linux.vnet.ibm.com>
Date: Thu, 9 Feb 2017 14:13:37 +0000 (+0100)
Subject: util: reset the counters to zero
X-Git-Tag: CVE-2017-2635~136
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c26fe44be59abdc44169a97ec973f13e0e747452;p=thirdparty%2Flibvirt.git

util: reset the counters to zero

After freeing the data structures we have to reset the counters to
zero. This fixes a segmentation fault when virNetDevIPInfoClear is
called twice (e.g. this is possible in virDomainNetDefParseXML() if
virDomainNetIPInfoParseXML(...) fails with ret < 0 (this leads to the
first call of 'virNetDevIPInfoClear(&def->guestIP)') and the resulting
call of virDomainNetDefFree(def) in the error path of
virDomainNetDefParseXML() (this leads to the second call of
virNetDevIPInfoClear(&def->guestIP), and finally to the segmentation
fault).

Signed-off-by: Marc Hartmayer <mhartmay@linux.vnet.ibm.com>
Reviewed-by: Boris Fiuczynski <fiuczy@linux.vnet.ibm.com>
Reviewed-by: Bjoern Walk <bwalk@linux.vnet.ibm.com>
---

diff --git a/src/util/virnetdevip.c b/src/util/virnetdevip.c
index d15976026c..42fbba1eb2 100644
--- a/src/util/virnetdevip.c
+++ b/src/util/virnetdevip.c
@@ -882,10 +882,12 @@ virNetDevIPInfoClear(virNetDevIPInfoPtr ip)
     for (i = 0; i < ip->nips; i++)
         VIR_FREE(ip->ips[i]);
     VIR_FREE(ip->ips);
+    ip->nips = 0;
 
     for (i = 0; i < ip->nroutes; i++)
         virNetDevIPRouteFree(ip->routes[i]);
     VIR_FREE(ip->routes);
+    ip->nroutes = 0;
 }