[Xen-changelog] [xen master] tools/libxc: Fix missing va_end() in do_dm_op() error path

[patchbot@xxxxxxx]

commit 7581a378b0b8727b6eaaa83da154e40bcfea0f69
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Mon Jan 30 10:08:50 2017 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Mon Jan 30 11:07:48 2017 +0000

    tools/libxc: Fix missing va_end() in do_dm_op() error path
    
    The fail3 error path skips the va_end() call, which typically leaks memory 
for
    64bit x86 code.
    
    Introduced by c/s 524a98c2ac5, spotted by Coverity.
    
    Coverity-ID: 1399608
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Wei Liu <wei.liu2@xxxxxxxxxx>
---
 tools/libxc/xc_private.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/libxc/xc_private.c b/tools/libxc/xc_private.c
index 809183c..f0e089c 100644
--- a/tools/libxc/xc_private.c
+++ b/tools/libxc/xc_private.c
@@ -803,7 +803,7 @@ int do_dm_op(xc_interface *xch, domid_t domid, unsigned int 
nr_bufs, ...)
 
         bounce[idx].h = xencall_alloc_buffer(xch->xcall, size);
         if ( bounce[idx].h == NULL )
-            goto fail3;
+            break; /* Error path handled after va_end(). */
 
         memcpy(bounce[idx].h, u, size);
         bounce[idx].u = u;
@@ -813,6 +813,9 @@ int do_dm_op(xc_interface *xch, domid_t domid, unsigned int 
nr_bufs, ...)
     }
     va_end(args);
 
+    if ( idx != nr_bufs )
+        goto fail3;
+
     ret = xencall3(xch->xcall, __HYPERVISOR_dm_op,
                    domid, nr_bufs, HYPERCALL_BUFFER_AS_ARG(bufs));
     if ( ret < 0 )
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog