From 4e394dea1f3a1cd4f4f6637ed91c9f7b367800c0 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Tue, 20 Dec 2011 08:22:25 -0700
Subject: [PATCH] rpc: handle param_int, plug memory leaks

The RPC code had several latent memory leaks and an attempt to
free the wrong string, but thankfully nothing triggered them
(blkiotune was the only one returning a string, and always as
the last parameter).  Also, our cleanups for rpcgen ended up
nuking a line of code that renders VIR_TYPED_PARAM_INT broken,
because it was the only use of 'i' in a function, even though
it was a member usage rather than a standalone declaration.

* daemon/remote.c (remoteSerializeTypedParameters): Free the
correct array element.
(remoteDispatchDomainGetSchedulerParameters)
(remoteDispatchDomainGetSchedulerParametersFlags)
(remoteDispatchDomainBlockStatsFlags)
(remoteDispatchDomainGetMemoryParameters): Don't leak strings.
* src/rpc/genprotocol.pl: Don't nuke member-usage of 'buf' or 'i'.
---
 daemon/remote.c        | 23 ++++++++++-------------
 src/rpc/genprotocol.pl |  8 ++++----
 2 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/daemon/remote.c b/daemon/remote.c
index e1d208c591..ad4c767d7c 100644
--- a/daemon/remote.c
+++ b/daemon/remote.c
@@ -759,7 +759,7 @@ cleanup:
     if (val) {
         for (i = 0; i < nparams; i++) {
             VIR_FREE(val[i].field);
-            if (params[i].type == VIR_TYPED_PARAM_STRING)
+            if (val[i].value.type == VIR_TYPED_PARAM_STRING)
                 VIR_FREE(val[i].value.remote_typed_param_value_u.s);
         }
         VIR_FREE(val);
@@ -898,9 +898,10 @@ remoteDispatchDomainGetSchedulerParameters(virNetServerPtr server ATTRIBUTE_UNUS
 cleanup:
     if (rv < 0)
         virNetMessageSaveError(rerr);
+    virTypedParameterArrayClear(params, nparams);
+    VIR_FREE(params);
     if (dom)
         virDomainFree(dom);
-    VIR_FREE(params);
     return rv;
 
 no_memory:
@@ -953,9 +954,10 @@ remoteDispatchDomainGetSchedulerParametersFlags(virNetServerPtr server ATTRIBUTE
 cleanup:
     if (rv < 0)
         virNetMessageSaveError(rerr);
+    virTypedParameterArrayClear(params, nparams);
+    VIR_FREE(params);
     if (dom)
         virDomainFree(dom);
-    VIR_FREE(params);
     return rv;
 
 no_memory:
@@ -1092,7 +1094,6 @@ remoteDispatchDomainBlockStatsFlags(virNetServerPtr server ATTRIBUTE_UNUSED,
 {
     virTypedParameterPtr params = NULL;
     virDomainPtr dom = NULL;
-    int i;
     const char *path = args->path;
     int nparams = args->nparams;
     unsigned int flags;
@@ -1140,17 +1141,12 @@ success:
     rv = 0;
 
 cleanup:
-    if (rv < 0) {
+    if (rv < 0)
         virNetMessageSaveError(rerr);
-        if (ret->params.params_val) {
-            for (i = 0; i < nparams; i++)
-                VIR_FREE(ret->params.params_val[i].field);
-            VIR_FREE(ret->params.params_val);
-        }
-    }
+    virTypedParameterArrayClear(params, nparams);
+    VIR_FREE(params);
     if (dom)
         virDomainFree(dom);
-    VIR_FREE(params);
     return rv;
 }
 
@@ -1623,9 +1619,10 @@ success:
 cleanup:
     if (rv < 0)
         virNetMessageSaveError(rerr);
+    virTypedParameterArrayClear(params, nparams);
+    VIR_FREE(params);
     if (dom)
         virDomainFree(dom);
-    VIR_FREE(params);
     return rv;
 }
 
diff --git a/src/rpc/genprotocol.pl b/src/rpc/genprotocol.pl
index 7af1b3bd12..48383255d9 100755
--- a/src/rpc/genprotocol.pl
+++ b/src/rpc/genprotocol.pl
@@ -67,12 +67,12 @@ while (<RPCGEN>) {
 	# Note: The body of the function is in @function.
 
 	# Remove decl of buf, if buf isn't used in the function.
-	my @uses = grep /\bbuf\b/, @function;
-	@function = grep !/\bbuf\b/, @function if @uses == 1;
+	my @uses = grep /[^.>]\bbuf\b/, @function;
+	@function = grep !/[^.>]\bbuf\b/, @function if @uses == 1;
 
 	# Remove decl of i, if i isn't used in the function.
-	@uses = grep /\bi\b/, @function;
-	@function = grep !/\bi\b/, @function if @uses == 1;
+	@uses = grep /[^.>]\bi\b/, @function;
+	@function = grep !/[^.>]\bi\b/, @function if @uses == 1;
 
 	# (char **)&objp->... gives:
 	# warning: dereferencing type-punned pointer will break