From ddb4aa5dfa13781e8f31ba20923c14c1a083ce83 Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Wed, 18 Jun 2014 19:04:14 +0100 Subject: [PATCH] tools/libxl: Fix free() of wild pointer in libxl__initiate_device_remove() libxl__initiate_device_remove() had a preexisting error path issue where libxl_dominfo_dispose() could be called on a libxl_dominfo object before it had been initialised with libxl_dominfo_init(). This was safe until c/s ab44401 added the pointer ssid_label, which point libxl_dominfo_dispose() free()s. Unconditionally initialise info in libxl__initiate_device_remove() before taking an error path which will free it. Coverity-ID: 1223212 Signed-off-by: Andrew Cooper CC: Wei Liu CC: Ian Campbell CC: Ian Jackson --- tools/libxl/libxl_device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/libxl/libxl_device.c b/tools/libxl/libxl_device.c index 90ae564ffb..788895b9b2 100644 --- a/tools/libxl/libxl_device.c +++ b/tools/libxl/libxl_device.c @@ -772,6 +772,8 @@ void libxl__initiate_device_remove(libxl__egc *egc, uint32_t my_domid, domid = aodev->dev->domid; int rc = 0; + libxl_dominfo_init(&info); + rc = libxl__get_domid(gc, &my_domid); if (rc) { LOG(ERROR, "unable to get my domid"); @@ -779,7 +781,6 @@ void libxl__initiate_device_remove(libxl__egc *egc, } if (my_domid == LIBXL_TOOLSTACK_DOMID) { - libxl_dominfo_init(&info); rc = libxl_domain_info(CTX, &info, domid); if (rc) { LOG(ERROR, "unable to get info for domain %d", domid); -- 2.30.2