qemu: fix infinite loop in OOM error path

A loop in qemuPrepareHostdevPCIDevices() intended to cycle through all
the objects on the list pcidevs was doing "while (listcount > 0)", but
nothing in the body of the loop was reducing the size of the list - it
was instead removing items from a *different* list. It has now been
safely changed to a for() loop.

diff --git a/src/qemu/qemu_hostdev.c b/src/qemu/qemu_hostdev.c
index 09ac6ad057fef5048e017bf261eb7149c17eaab7..404939e78ddd917aabd4e06ceff08e62811c0ea1 100644 (file)
--- a/src/qemu/qemu_hostdev.c
+++ b/src/qemu/qemu_hostdev.c
@@ -638,8 +638,8 @@ inactivedevs:
     /* Only steal all the devices from driver->activePciHostdevs. We will
      * free them in virObjectUnref().
      */
-    while (virPCIDeviceListCount(pcidevs) > 0) {
-        virPCIDevicePtr dev = virPCIDeviceListGet(pcidevs, 0);
+    for (i = 0; i < virPCIDeviceListCount(pcidevs); i++) {
+        virPCIDevicePtr dev = virPCIDeviceListGet(pcidevs, i);
         virPCIDeviceListSteal(driver->activePciHostdevs, dev);
     }