From 55714f78c4309c89f35db2bbb5ab48872493b4ec Mon Sep 17 00:00:00 2001 From: Maxim Nestratov Date: Thu, 21 May 2015 16:49:35 +0300 Subject: [PATCH] parallels: fix possible crash in case of errors in prlsdkLoadDomain Cleanup code in prlsdkLoadDomain doesn't take into account the fact if private domain structure along with freeing function is assigned or not. In case it is, we shouldn't call it manually because virDomainObjListRemove calls it and frees pdom. Also, allocated def structure should be freed only if it's not assigned to domain. Otherwise it will be called twice: one time by virDomainObjListRemove and the second by prlsdkLoadDomain itself. Signed-off-by: Maxim Nestratov --- src/parallels/parallels_sdk.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/src/parallels/parallels_sdk.c b/src/parallels/parallels_sdk.c index 553a8775d6..bedee2c5f7 100644 --- a/src/parallels/parallels_sdk.c +++ b/src/parallels/parallels_sdk.c @@ -1379,10 +1379,21 @@ prlsdkLoadDomain(parallelsConnPtr privconn, return dom; error: - if (dom && !olddom) + if (dom && !olddom) { + /* Domain isn't persistent means that we haven't yet set + * prlsdkDomObjFreePrivate and should call it manually + */ + if (!dom->persistent) + prlsdkDomObjFreePrivate(pdom); + virDomainObjListRemove(privconn->domains, dom); - virDomainDefFree(def); - prlsdkDomObjFreePrivate(pdom); + } + /* Delete newly allocated def only if we haven't assigned it to domain + * Otherwise we will end up with domain having invalid def within it + */ + if (!dom) + virDomainDefFree(def); + return NULL; } -- 2.47.2