shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-11 09:17:52 +03:00
Code Releases Activity

conf: Fix heap corruption when hot-adding a lease

Browse Source 
Commit 28a8699316 ( v6.9.0-179-g28a8699316 ) incorrectly replaced
VIR_EXPAND_N by g_renew.

VIR_EXPAND_N has these two extra effects apart from reallocating memory:

1) The newly allocated memory is zeroed out
2) The number of elements in the array which is passed to VIR_EXPAND_N
   is increased.

This comes into play when used with virDomainLeaseInsertPreAlloced,
which expects that the array element count already includes the space
for the added 'lease', by plainly just assigning to
'leases[nleases - 1]'

Since g_renew does not increase the number of elements in the array
any existing code which calls virDomainLeaseInsertPreAlloced thus either
overwrites a lease definition or corrupts the heap if there are no
leases to start with.

To preserve existing functionality we revert the code back to using
VIR_EXPAND_N which at this point doesn't return any value, so other
commits don't need to be reverted.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1953577
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
This commit is contained in:
Peter Krempa 2021-05-02 11:45:22 +02:00
parent ec2e3336b8
commit 6dca93e4bc
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/conf/domain_conf.c
View File

@ -16837,7 +16837,7 @@ int virDomainLeaseIndex(virDomainDef *def,
void virDomainLeaseInsertPreAlloc(virDomainDef *def)
{
def->leases = g_renew(virDomainLeaseDef *, def->leases, def->nleases + 1);
VIR_EXPAND_N(def->leases, def->nleases, 1);
}
void virDomainLeaseInsert(virDomainDef *def, virDomainLeaseDef *lease)