From: Ian Campbell <ian.campbell@citrix.com>
Date: Wed, 28 Sep 2011 15:35:44 +0000 (+0100)
Subject: libxl: correct allocation size in libxl_list_nics
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~9854
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/success//%22http:/www.example.com/cgi/success/?a=commitdiff_plain;h=6dac205d0453e0b92e6d8b736bd4805da06e3123;p=xen.git

libxl: correct allocation size in libxl_list_nics

The function returns a list of libxl_nicinfo not libxl_device_nic.

Causes memory corruption on free.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
---

diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c
index 3dc7b5be9e..ce76cffd7d 100644
--- a/tools/libxl/libxl.c
+++ b/tools/libxl/libxl.c
@@ -1296,7 +1296,7 @@ libxl_nicinfo *libxl_list_nics(libxl_ctx *ctx, uint32_t domid, unsigned int *nb)
                            libxl__sprintf(&gc, "%s/device/vif", dompath), &nb_nics);
     if (!l)
         goto err;
-    nics = res = calloc(nb_nics, sizeof (libxl_device_nic));
+    nics = res = calloc(nb_nics, sizeof (libxl_nicinfo));
     if (!res)
         goto err;
     for (*nb = nb_nics; nb_nics > 0; --nb_nics, ++l, ++nics) {