From 6b663b6fd1a5d7e80872792a762c8920d0936d32 Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" Date: Wed, 25 Sep 2013 10:22:42 +0100 Subject: [PATCH] Fix crash on OOM parsing storage pool XML The virStoragePoolDefParseSource method would set def->nhosts before allocating def->hosts. If the allocation failed due to OOM, the cleanup code would crash accessing out of bounds. Signed-off-by: Daniel P. Berrange --- src/conf/storage_conf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c index 002663f1e4..975e662641 100644 --- a/src/conf/storage_conf.c +++ b/src/conf/storage_conf.c @@ -594,11 +594,11 @@ virStoragePoolDefParseSource(xmlXPathContextPtr ctxt, if ((n = virXPathNodeSet("./host", ctxt, &nodeset)) < 0) goto cleanup; - source->nhost = n; - if (source->nhost) { - if (VIR_ALLOC_N(source->hosts, source->nhost) < 0) + if (n) { + if (VIR_ALLOC_N(source->hosts, n) < 0) goto cleanup; + source->nhost = n; for (i = 0; i < source->nhost; i++) { name = virXMLPropString(nodeset[i], "name"); -- 2.47.2