From: Jiri Denemark <jdenemar@redhat.com>
Date: Wed, 25 Jan 2023 14:06:33 +0000 (+0100)
Subject: remote: Avoid leaking uri_out
X-Git-Tag: v9.1.0-rc1~157
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d0f339170f35957e7541e5b20552d0007e150fbc;p=thirdparty%2Flibvirt.git

remote: Avoid leaking uri_out

In case the API returned success and a NULL pointer in uri_out, we would
leak the preallocated buffer used for storing the uri_out pointer.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
---

diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
index 4d993afee6..54afa5c2f4 100644
--- a/src/remote/remote_daemon_dispatch.c
+++ b/src/remote/remote_daemon_dispatch.c
@@ -3062,15 +3062,14 @@ remoteDispatchDomainMigratePrepare2(virNetServer *server G_GNUC_UNUSED,
      */
     ret->cookie.cookie_len = cookielen;
     ret->cookie.cookie_val = cookie;
-    ret->uri_out = *uri_out == NULL ? NULL : uri_out;
+    ret->uri_out = *uri_out == NULL ? NULL : g_steal_pointer(&uri_out);
 
     rv = 0;
 
  cleanup:
-    if (rv < 0) {
+    if (rv < 0)
         virNetMessageSaveError(rerr);
-        VIR_FREE(uri_out);
-    }
+    VIR_FREE(uri_out);
     return rv;
 }
 
@@ -4777,15 +4776,14 @@ remoteDispatchDomainMigratePrepare3(virNetServer *server G_GNUC_UNUSED,
      */
     ret->cookie_out.cookie_out_len = cookieoutlen;
     ret->cookie_out.cookie_out_val = cookieout;
-    ret->uri_out = *uri_out == NULL ? NULL : uri_out;
+    ret->uri_out = *uri_out == NULL ? NULL : g_steal_pointer(&uri_out);
 
     rv = 0;
 
  cleanup:
-    if (rv < 0) {
+    if (rv < 0)
         virNetMessageSaveError(rerr);
-        VIR_FREE(uri_out);
-    }
+    VIR_FREE(uri_out);
     return rv;
 }
 
@@ -5573,16 +5571,15 @@ remoteDispatchDomainMigratePrepare3Params(virNetServer *server G_GNUC_UNUSED,
 
     ret->cookie_out.cookie_out_len = cookieoutlen;
     ret->cookie_out.cookie_out_val = cookieout;
-    ret->uri_out = !*uri_out ? NULL : uri_out;
+    ret->uri_out = !*uri_out ? NULL : g_steal_pointer(&uri_out);
 
     rv = 0;
 
  cleanup:
     virTypedParamsFree(params, nparams);
-    if (rv < 0) {
+    if (rv < 0)
         virNetMessageSaveError(rerr);
-        VIR_FREE(uri_out);
-    }
+    VIR_FREE(uri_out);
     return rv;
 }