[Xen-devel] [PATCH] tools/libxc: Fix missing va_end() in do_dm_op() error path

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

The fail3 error path skips the va_end() call, which typically leaks memory for
64bit x86 code.

Introduced by c/s 524a98c2ac5, spotted by Coverity.

Coverity-ID: 1399608
Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CC: Wei Liu <wei.liu2@xxxxxxxxxx>
---
 tools/libxc/xc_private.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/libxc/xc_private.c b/tools/libxc/xc_private.c
index 809183c..f0e089c 100644
--- a/tools/libxc/xc_private.c
+++ b/tools/libxc/xc_private.c
@@ -803,7 +803,7 @@ int do_dm_op(xc_interface *xch, domid_t domid, unsigned int 
nr_bufs, ...)
 
         bounce[idx].h = xencall_alloc_buffer(xch->xcall, size);
         if ( bounce[idx].h == NULL )
-            goto fail3;
+            break; /* Error path handled after va_end(). */
 
         memcpy(bounce[idx].h, u, size);
         bounce[idx].u = u;
@@ -813,6 +813,9 @@ int do_dm_op(xc_interface *xch, domid_t domid, unsigned int 
nr_bufs, ...)
     }
     va_end(args);
 
+    if ( idx != nr_bufs )
+        goto fail3;
+
     ret = xencall3(xch->xcall, __HYPERVISOR_dm_op,
                    domid, nr_bufs, HYPERCALL_BUFFER_AS_ARG(bufs));
     if ( ret < 0 )
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel