From: Ján Tomko <jtomko@redhat.com>
Date: Fri, 26 Jul 2013 10:04:32 +0000 (+0200)
Subject: Set the number of elements 0 in virNetwork*Clear
X-Git-Tag: v1.0.5.5~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f32ea9937f17ae32624cf0ba4b93fa0fbcaa2de2;p=thirdparty%2Flibvirt.git

Set the number of elements 0 in virNetwork*Clear

Decrementing it when it was already 0 causes an invalid free
in virNetworkDefUpdateDNSHost if virNetworkDNSHostDefParseXML
fails and virNetworkDNSHostDefClear gets called twice.

virNetworkForwardDefClear left the number untouched even if it
freed all the elements.
(cherry picked from commit c4e23388e6c7f769e45d1c162f880cd81e4d4d3b)
---

diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index ae7a8603b1..a92003538a 100644
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -134,8 +134,8 @@ virNetworkIpDefClear(virNetworkIpDefPtr def)
     VIR_FREE(def->family);
     VIR_FREE(def->ranges);
 
-    while (def->nhosts--)
-        virNetworkDHCPHostDefClear(&def->hosts[def->nhosts]);
+    while (def->nhosts)
+        virNetworkDHCPHostDefClear(&def->hosts[--def->nhosts]);
 
     VIR_FREE(def->hosts);
     VIR_FREE(def->tftproot);
@@ -152,8 +152,8 @@ virNetworkDNSTxtDefClear(virNetworkDNSTxtDefPtr def)
 static void
 virNetworkDNSHostDefClear(virNetworkDNSHostDefPtr def)
 {
-    while (def->nnames--)
-        VIR_FREE(def->names[def->nnames]);
+    while (def->nnames)
+        VIR_FREE(def->names[--def->nnames]);
     VIR_FREE(def->names);
 }
 
@@ -170,18 +170,18 @@ static void
 virNetworkDNSDefClear(virNetworkDNSDefPtr def)
 {
     if (def->txts) {
-        while (def->ntxts--)
-            virNetworkDNSTxtDefClear(&def->txts[def->ntxts]);
+        while (def->ntxts)
+            virNetworkDNSTxtDefClear(&def->txts[--def->ntxts]);
         VIR_FREE(def->txts);
     }
     if (def->hosts) {
-        while (def->nhosts--)
-            virNetworkDNSHostDefClear(&def->hosts[def->nhosts]);
+        while (def->nhosts)
+            virNetworkDNSHostDefClear(&def->hosts[--def->nhosts]);
         VIR_FREE(def->hosts);
     }
     if (def->srvs) {
-        while (def->nsrvs--)
-            virNetworkDNSSrvDefClear(&def->srvs[def->nsrvs]);
+        while (def->nsrvs)
+            virNetworkDNSSrvDefClear(&def->srvs[--def->nsrvs]);
         VIR_FREE(def->srvs);
     }
 }
@@ -200,6 +200,7 @@ virNetworkForwardDefClear(virNetworkForwardDefPtr def)
         virNetworkForwardIfDefClear(&def->ifs[ii]);
     }
     VIR_FREE(def->ifs);
+    def->nifs = def->npfs = 0;
 }
 
 void