Fix segmentation fault when accessing default qemu machine type

This patch fixes a segmentation fault when creating new virtual machines using QEMU.
The segmentation fault is caused by commit f41830680e40d3ec845cefd25419bd87414b9ccf
and commit cbb6ec42e2447d7920b30d66923b2a2b2670133b.

In virQEMUCapsProbeQMPMachineTypes, when copying machines to qemuCaps, "none" is skipped.
Therefore, the value of i and "qemuCaps->nmachineTypes - 1" do not always match.
However, defIdx value (used to call virQEMUCapsSetDefaultMachine) is set using the value in i
when the array elements are in qemuCaps->nmachineTypes - 1.
So, when libvirt tries to create virtual machines using the default machine type,
qemuCaps->machineTypes[defIdx] is accessed and since the defIdx is NULL, it results in segmentation fault.

Signed-off-by: Yudai Yamagishi <yummy@sfc.wide.ad.jp>
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>

diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index ed182e00227402b420d3c6dc6b1c9c9871102501..0538115811dac39bedfd2c5fe4ebea438d60968c 100644 (file)
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -2151,7 +2151,7 @@ virQEMUCapsProbeQMPMachineTypes(virQEMUCapsPtr qemuCaps,
                        machines[i]->name) < 0)
             goto cleanup;
         if (machines[i]->isDefault)
-            defIdx = i;
+            defIdx = qemuCaps->nmachineTypes - 1;
         qemuCaps->machineMaxCpus[qemuCaps->nmachineTypes - 1] =
             machines[i]->maxCpus;
     }