[Xen-devel] [PATCH 3/4] tools/libxl: Fix libxl__device_nic_from_xs_be()

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

Coverity ID: 1055886

The callers of xs_read() is required to free the allocated memory.  Also avoid
calling libxl__parse_mac(NULL,) if the second xs_read() fails.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CC: Ian Campbell <Ian.Campbell@xxxxxxxxxx>
CC: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
---
 tools/libxl/libxl.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c
index 2b847ef..d8dae3e 100644
--- a/tools/libxl/libxl.c
+++ b/tools/libxl/libxl.c
@@ -2983,14 +2983,15 @@ static void libxl__device_nic_from_xs_be(libxl__gc *gc,
     libxl_ctx *ctx = libxl__gc_owner(gc);
     unsigned int len;
     char *tmp;
-    int rc;
 
     libxl_device_nic_init(nic);
 
     tmp = xs_read(ctx->xsh, XBT_NULL,
                   libxl__sprintf(gc, "%s/handle", be_path), &len);
-    if ( tmp )
+    if ( tmp ) {
         nic->devid = atoi(tmp);
+        free(tmp);
+    }
     else
         nic->devid = 0;
 
@@ -2998,10 +2999,12 @@ static void libxl__device_nic_from_xs_be(libxl__gc *gc,
 
     tmp = xs_read(ctx->xsh, XBT_NULL,
                   libxl__sprintf(gc, "%s/mac", be_path), &len);
-    rc = libxl__parse_mac(tmp, nic->mac);
-    if (rc)
+
+    if ( !tmp || libxl__parse_mac(tmp, nic->mac) != 0 )
         memset(nic->mac, 0, sizeof(nic->mac));
 
+    free(tmp);
+
     nic->ip = xs_read(ctx->xsh, XBT_NULL,
                       libxl__sprintf(gc, "%s/ip", be_path), &len);
 
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel