Re: [Xen-devel] [PATCH 08/13] libxl: don't leak ptr in libxl_list_vm error case

[Matthew Daley <mattd@xxxxxxxxxxx>]

On Mon, Dec 2, 2013 at 1:20 AM, Andrew Cooper <andrew.cooper3@xxxxxxxxxx> wrote:
> On 01/12/2013 10:15, Matthew Daley wrote:
>> While at it, tidy up the function; there's no point in allocating more
>> than the amount of domains actually returned by xc_domain_getinfolist.
>>
>> Coverity-ID: 1055888
>> Signed-off-by: Matthew Daley <mattd@xxxxxxxxxxx>
>> ---
>>  tools/libxl/libxl.c |   14 +++++++-------
>>  1 file changed, 7 insertions(+), 7 deletions(-)
>>
>> diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c
>> index a57d571..ca4c2cd 100644
>> --- a/tools/libxl/libxl.c
>> +++ b/tools/libxl/libxl.c
>> @@ -674,17 +674,17 @@ libxl_vminfo * libxl_list_vm(libxl_ctx *ctx, int 
>> *nb_vm_out)
>>      libxl_vminfo *ptr;
>>      int idx, i, ret;
>>      xc_domaininfo_t info[1024];
>> -    int size = 1024;
>>
>> -    ptr = calloc(size, sizeof(libxl_vminfo));
>> -    if (!ptr)
>> +    ret = xc_domain_getinfolist(ctx->xch, 1, ARRAY_SIZE(info), info);
>> +    if (ret < 0) {
>> +        LIBXL__LOG_ERRNO(ctx, LIBXL__LOG_ERROR, "getting domain info list");
>>          return NULL;
>> +    }
>>
>> -    ret = xc_domain_getinfolist(ctx->xch, 1, 1024, info);
>> -    if (ret<0) {
>> -        LIBXL__LOG_ERRNO(ctx, LIBXL__LOG_ERROR, "geting domain info list");
>> +    ptr = calloc(ret, sizeof(libxl_vminfo));
>
> We now have a possible case of calling calloc(0, sizeof(libxl_vminfo));
>
> The implementation is free to return NULL which will cause this function
> to fail in the eyes of its callers.

Good catch.

>
> Doing a calloc(min(1,ret), sizeof(libxl_vminfo)); will suffice, as the
> callers already have to correctly deal with 0 domains but some allocated
> memory as a result of this function.

v2 on its way...

- Matthew

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel