xenstat: Fix buffer over-run with new_domains being negative.

Coverity identified this as:
CID 1055740 Out-of-bounds read - "In xenstat_get_node:
Out-of-bounds read from a buffer (CWE-125)"

And sure enough, if xc_domain_getinfolist returns us -1, we will
try to use it later on in the for (i = 0; i < new_domains; ..)
loop.

Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
This commit is contained in:
Konrad Rzeszutek Wilk authored and Ian Campbell committed 2013-09-13 13:12:29 +01:00
1 parent ae763e4224
commit 1438d36f96
1 file changed
+9 -5
+9 -5
View File
@@ -208,15 +208,15 @@ xenstat_node *xenstat_get_node(xenstat_handle * handle, unsigned int flags)
node->num_domains,
DOMAIN_CHUNK_SIZE,
domaininfo);
if (new_domains < 0)
goto err;
tmp = realloc(node->domains,
(node->num_domains + new_domains)
* sizeof(xenstat_domain));
if (tmp == NULL) {
free(node->domains);
free(node);
return NULL;
}
if (tmp == NULL)
goto err;
node->domains = tmp;
domain = node->domains + node->num_domains;
@@ -280,6 +280,10 @@ xenstat_node *xenstat_get_node(xenstat_handle * handle, unsigned int flags)
}
return node;
err:
free(node->domains);
free(node);
return NULL;
}
void xenstat_free_node(xenstat_node * node)
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.