[Pkg-libvirt-commits] [libguestfs] 58/233: drives: Avoid double-free along error path.

[Hilko Bengen]

This is an automated email from the git hooks/post-receive script.

bengen pushed a commit to branch experimental
in repository libguestfs.

commit f106b30c41996a9dedd699c1301f0c3eea1ee6b8
Author: Richard W.M. Jones <rjones at redhat.com>
Date:   Fri Jan 17 12:14:38 2014 +0000

    drives: Avoid double-free along error path.
    
    This fixes commit 4a0f5ed38233393e75ea69ff0595936aed0e8abb.
    
    A simple test of this:
    
      guestfish <<EOF
      add-drive "" readonly:1 format:raw protocol:nbd server:localhost:10000
      EOF
    
    which would core dump.
---
 src/drives.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/drives.c b/src/drives.c
index 4911e73..4f8a7c5 100644
--- a/src/drives.c
+++ b/src/drives.c
@@ -132,6 +132,10 @@ create_drive_file (guestfs_h *g, const char *path,
 
   if (readonly) {
     if (create_overlay (g, drv) == -1) {
+      /* Don't double-free the servers in free_drive_struct, since
+       * they are owned by the caller along this error path.
+       */
+      drv->src.servers = NULL; drv->src.nr_servers = 0;
       free_drive_struct (drv);
       return NULL;
     }
@@ -168,6 +172,10 @@ create_drive_non_file (guestfs_h *g,
 
   if (readonly) {
     if (create_overlay (g, drv) == -1) {
+      /* Don't double-free the servers in free_drive_struct, since
+       * they are owned by the caller along this error path.
+       */
+      drv->src.servers = NULL; drv->src.nr_servers = 0;
       free_drive_struct (drv);
       return NULL;
     }

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-libvirt/libguestfs.git