From 5a66c667ff5cae61c2ad2e646c8eb3eedc67f925 Mon Sep 17 00:00:00 2001
From: Peter Krempa <pkrempa@redhat.com>
Date: Wed, 13 Nov 2013 11:56:47 +0100
Subject: [PATCH] snapshot: conf: Fix NULL dereference when <driver> element is
 empty

Consider the following valid snapshot XML as the <driver> element is
allowed to be empty in the domainsnapshot.rng schema:

$ cat snap.xml
<domainsnapshot>
  <disks>
    <disk name='vda' snapshot='external'>
      <source file='/tmp/foo'/>
      <driver/>
    </disk>
  </disks>
</domainsnapshot>

produces the following error:

$ virsh snapshot-create domain snap.xml
error: internal error: unknown disk snapshot driver '(null)'

The driver type is parsed as NULL from the XML as the attribute is not
present and then directly used to produce the error message.

With this patch the attempt to parse the driver type is skipped if not
present to avoid changing the schema to forbid the empty driver element.
---
 src/conf/snapshot_conf.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/conf/snapshot_conf.c b/src/conf/snapshot_conf.c
index 67df442f3f..563797529c 100644
--- a/src/conf/snapshot_conf.c
+++ b/src/conf/snapshot_conf.c
@@ -154,15 +154,17 @@ virDomainSnapshotDiskDefParseXML(xmlNodePtr node,
         } else if (!def->format &&
                    xmlStrEqual(cur->name, BAD_CAST "driver")) {
             char *driver = virXMLPropString(cur, "type");
-            def->format = virStorageFileFormatTypeFromString(driver);
-            if (def->format <= 0) {
-                virReportError(VIR_ERR_INTERNAL_ERROR,
-                               _("unknown disk snapshot driver '%s'"),
-                               driver);
+            if (driver) {
+                def->format = virStorageFileFormatTypeFromString(driver);
+                if (def->format <= 0) {
+                    virReportError(VIR_ERR_INTERNAL_ERROR,
+                                   _("unknown disk snapshot driver '%s'"),
+                                   driver);
+                    VIR_FREE(driver);
+                    goto cleanup;
+                }
                 VIR_FREE(driver);
-                goto cleanup;
             }
-            VIR_FREE(driver);
         }
     }
 
-- 
2.47.2