From 1dfb44be050bc7605b452ab7c745e797b74db79f Mon Sep 17 00:00:00 2001 From: Rob Hoes Date: Mon, 9 Dec 2013 15:17:29 +0000 Subject: [PATCH] libxl: ocaml: fix memory corruption when converting string and key/values lists Found by Coverty. CIDs: 1128562 1128563 1128564 1128565. Signed-off-by: Rob Hoes Reviewed-by: Andrew Cooper Acked-by: David Scott Acked-by: Ian Campbell --- tools/ocaml/libs/xl/xenlight_stubs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/ocaml/libs/xl/xenlight_stubs.c b/tools/ocaml/libs/xl/xenlight_stubs.c index 80a59864f0..4ea2047b80 100644 --- a/tools/ocaml/libs/xl/xenlight_stubs.c +++ b/tools/ocaml/libs/xl/xenlight_stubs.c @@ -151,8 +151,8 @@ static value Val_key_value_list(libxl_key_value_list *c_val) list = Val_emptylist; for (i = libxl_string_list_length((libxl_string_list *) c_val) - 1; i >= 0; i -= 2) { - val = caml_copy_string((char *) c_val[i]); - key = caml_copy_string((char *) c_val[i - 1]); + val = caml_copy_string((*c_val)[i]); + key = caml_copy_string((*c_val)[i - 1]); kv = caml_alloc_tuple(2); Store_field(kv, 0, key); Store_field(kv, 1, val); @@ -193,7 +193,7 @@ static value Val_string_list(libxl_string_list *c_val) list = Val_emptylist; for (i = libxl_string_list_length(c_val) - 1; i >= 0; i--) { - string = caml_copy_string((char *) c_val[i]); + string = caml_copy_string((*c_val)[i]); cons = caml_alloc(2, 0); Store_field(cons, 0, string); // head Store_field(cons, 1, list); // tail -- 2.30.2