tools/libxc: Fix missing va_end() in do_dm_op() error path

The fail3 error path skips the va_end() call, which typically leaks memory for
64bit x86 code.

Introduced by c/s 524a98c2ac5, spotted by Coverity.

Coverity-ID: 1399608
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>

diff --git a/tools/libxc/xc_private.c b/tools/libxc/xc_private.c
index 809183c0d4449da24aec7dcbf5f948d7eb3326ed..f0e089c704454975a31bf0c9bfbd680b9c513611 100644 (file)
--- a/tools/libxc/xc_private.c
+++ b/tools/libxc/xc_private.c
@@ -803,7 +803,7 @@ int do_dm_op(xc_interface *xch, domid_t domid, unsigned int nr_bufs, ...)
 
         bounce[idx].h = xencall_alloc_buffer(xch->xcall, size);
         if ( bounce[idx].h == NULL )
-            goto fail3;
+            break; /* Error path handled after va_end(). */
 
         memcpy(bounce[idx].h, u, size);
         bounce[idx].u = u;
@@ -813,6 +813,9 @@ int do_dm_op(xc_interface *xch, domid_t domid, unsigned int nr_bufs, ...)
     }
     va_end(args);
 
+    if ( idx != nr_bufs )
+        goto fail3;
+
     ret = xencall3(xch->xcall, __HYPERVISOR_dm_op,
                    domid, nr_bufs, HYPERCALL_BUFFER_AS_ARG(bufs));
     if ( ret < 0 )