From: Daniel P. Berrange <berrange@redhat.com>
Date: Wed, 25 Sep 2013 08:30:20 +0000 (+0100)
Subject: Fix crash on OOM in xenParseSxpr
X-Git-Tag: v1.1.3-rc1~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d508f70df0f400fe66ac9c94fa0b79318b73de26;p=thirdparty%2Flibvirt.git

Fix crash on OOM in xenParseSxpr

The xenParseSxpr method sets def->nconsoles to 1 before allocating
the def->consoles array. If the allocation fails due to OOM the
cleanup code will thus crash accessing out of bounds.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---

diff --git a/src/xenxs/xen_sxpr.c b/src/xenxs/xen_sxpr.c
index 6209c683a6..462eac6a99 100644
--- a/src/xenxs/xen_sxpr.c
+++ b/src/xenxs/xen_sxpr.c
@@ -1439,9 +1439,9 @@ xenParseSxpr(const struct sexpr *root,
             def->parallels[def->nparallels++] = chr;
         }
     } else if (def->id != 0) {
-        def->nconsoles = 1;
         if (VIR_ALLOC_N(def->consoles, 1) < 0)
             goto error;
+        def->nconsoles = 1;
         /* Fake a paravirt console, since that's not in the sexpr */
         if (!(def->consoles[0] = xenParseSxprChar("pty", tty)))
             goto error;