From: John Ferlan <jferlan@redhat.com>
Date: Wed, 27 Aug 2014 11:40:02 +0000 (-0400)
Subject: xen_common: Resolve Coverity USE_AFTER_FREE
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=0454f23c3125ef7bd3ffd1f5fa9643c108d9a4d4;p=libvirt.git

xen_common: Resolve Coverity USE_AFTER_FREE

There were two warnings in this module

  If the VIR_ALLOC_N(def->serials, 1) fails, then a virDomainChrDefFree(chr)
  is called and we jump to cleanup which makes the same call. Just remove
  the one after VIR_ALLOC_N()

  In the label "skipnic:" a virDomainNetDefFree(net) is made; however, if
  in going back to the top of the loop we jump back down to skipnic for any
  reason, the call will attempt to free an already freed structure since
  "net" was not passed by reference to virDomainNetDefFree().  Just set
  net = NULL in skipnic: to resolve the issue.
---

diff --git a/src/xenconfig/xen_common.c b/src/xenconfig/xen_common.c
index 2f53c633af..9beaf6c638 100644
--- a/src/xenconfig/xen_common.c
+++ b/src/xenconfig/xen_common.c
@@ -776,10 +776,8 @@ xenParseCharDev(virConfPtr conf, virDomainDefPtr def)
                 !(chr = xenParseSxprChar(str, NULL)))
                 goto cleanup;
             if (chr) {
-                if (VIR_ALLOC_N(def->serials, 1) < 0) {
-                    virDomainChrDefFree(chr);
+                if (VIR_ALLOC_N(def->serials, 1) < 0)
                     goto cleanup;
-                }
                 chr->deviceType = VIR_DOMAIN_CHR_DEVICE_TYPE_SERIAL;
                 chr->target.port = 0;
                 def->serials[0] = chr;
@@ -953,6 +951,7 @@ xenParseVif(virConfPtr conf, virDomainDefPtr def)
         skipnic:
             list = list->next;
             virDomainNetDefFree(net);
+            net = NULL;
             VIR_FREE(script);
         }
     }