If testQemuHotplugAttach succeeds, the vm->def steals the dev pointer.
However, not the envelope, which needs to be freed. In addition,
driver.config is allocated, but never freed.
switch (dev->type) {
case VIR_DOMAIN_DEVICE_CHR:
ret = qemuDomainAttachChrDevice(&driver, vm, dev->data.chr);
+ if (!ret) {
+ /* vm->def stolen dev->data.chr so we ought to avoid freeing it */
+ dev->data.chr = NULL;
+ }
break;
default:
if (virTestGetVerbose())
switch (test->action) {
case ATTACH:
ret = testQemuHotplugAttach(vm, dev);
- if (!ret) {
- /* avoid @dev double free on success,
- * as @dev is part of vm->def now */
- dev = NULL;
- }
break;
case DETACH:
virObjectUnref(driver.caps);
virObjectUnref(driver.xmlopt);
+ virObjectUnref(driver.config);
return (ret == 0) ? EXIT_SUCCESS : EXIT_FAILURE;
}