From 0454f23c3125ef7bd3ffd1f5fa9643c108d9a4d4 Mon Sep 17 00:00:00 2001 From: John Ferlan Date: Wed, 27 Aug 2014 07:40:02 -0400 Subject: [PATCH] xen_common: Resolve Coverity USE_AFTER_FREE There were two warnings in this module If the VIR_ALLOC_N(def->serials, 1) fails, then a virDomainChrDefFree(chr) is called and we jump to cleanup which makes the same call. Just remove the one after VIR_ALLOC_N() In the label "skipnic:" a virDomainNetDefFree(net) is made; however, if in going back to the top of the loop we jump back down to skipnic for any reason, the call will attempt to free an already freed structure since "net" was not passed by reference to virDomainNetDefFree(). Just set net = NULL in skipnic: to resolve the issue. --- src/xenconfig/xen_common.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/xenconfig/xen_common.c b/src/xenconfig/xen_common.c index 2f53c633af..9beaf6c638 100644 --- a/src/xenconfig/xen_common.c +++ b/src/xenconfig/xen_common.c @@ -776,10 +776,8 @@ xenParseCharDev(virConfPtr conf, virDomainDefPtr def) !(chr = xenParseSxprChar(str, NULL))) goto cleanup; if (chr) { - if (VIR_ALLOC_N(def->serials, 1) < 0) { - virDomainChrDefFree(chr); + if (VIR_ALLOC_N(def->serials, 1) < 0) goto cleanup; - } chr->deviceType = VIR_DOMAIN_CHR_DEVICE_TYPE_SERIAL; chr->target.port = 0; def->serials[0] = chr; @@ -953,6 +951,7 @@ xenParseVif(virConfPtr conf, virDomainDefPtr def) skipnic: list = list->next; virDomainNetDefFree(net); + net = NULL; VIR_FREE(script); } } -- 2.39.5