File 54f4985f-libxl-fix-libvirtd-double-free.patch of Package xen.7317

References: bsc#949138

Subject: libxl: make some _dispose functions idempotent and tolerate NULL
From: Wei Liu wei.liu2@citrix.com Wed Feb 25 14:56:02 2015 +0000
Date: Mon Mar 2 17:05:35 2015 +0000:
Git: 1ea68f1a82ef94b3cc644fa70307c5151f356baf

These functions are not generated, so we need to do it by hand.

Functions list:
 libxl_bitmap_dispose
 libxl_string_list_dispose
 libxl_key_value_list_dipose
 libxl_cpuid_dispose

Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>

Index: xen-4.4.3-testing/tools/libxl/libxl.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl.c
+++ xen-4.4.3-testing/tools/libxl/libxl.c
@@ -195,9 +195,12 @@ void libxl_string_list_dispose(libxl_str
     if (!sl)
         return;
 
-    for (i = 0; sl[i] != NULL; i++)
+    for (i = 0; sl[i] != NULL; i++) {
         free(sl[i]);
+        sl[i] = NULL;
+    }
     free(sl);
+    *psl = NULL;
 }
 
 int libxl_string_list_length(const libxl_string_list *psl)
@@ -221,10 +224,14 @@ void libxl_key_value_list_dispose(libxl_
 
     for (i = 0; kvl[i] != NULL; i += 2) {
         free(kvl[i]);
-        if (kvl[i + 1])
+        kvl[i] = NULL;
+        if (kvl[i + 1]) {
             free(kvl[i + 1]);
+            kvl[i+1] = NULL;
+        }
     }
     free(kvl);
+    *pkvl = NULL;
 }
 
 #define LIBXL__DEFBOOL_DEFAULT (0)
Index: xen-4.4.3-testing/tools/libxl/libxl_cpuid.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_cpuid.c
+++ xen-4.4.3-testing/tools/libxl/libxl_cpuid.c
@@ -23,10 +23,13 @@ void libxl_cpuid_dispose(libxl_cpuid_pol
         return;
     for (i = 0; cpuid_list[i].input[0] != XEN_CPUID_INPUT_UNUSED; i++) {
         for (j = 0; j < 4; j++)
-            if (cpuid_list[i].policy[j] != NULL)
+            if (cpuid_list[i].policy[j] != NULL) {
                 free(cpuid_list[i].policy[j]);
+                cpuid_list[i].policy[j] = NULL;
+            }
     }
     free(cpuid_list);
+    *p_cpuid_list = NULL;
     return;
 }
 
Index: xen-4.4.3-testing/tools/libxl/libxl_utils.c
===================================================================
--- xen-4.4.3-testing.orig/tools/libxl/libxl_utils.c
+++ xen-4.4.3-testing/tools/libxl/libxl_utils.c
@@ -570,7 +570,12 @@ void libxl_bitmap_init(libxl_bitmap *map
 
 void libxl_bitmap_dispose(libxl_bitmap *map)
 {
+    if (!map)
+        return;
+
     free(map->map);
+    map->map = NULL;
+    map->size = 0;
 }
 
 void libxl_bitmap_copy(libxl_ctx *ctx, libxl_bitmap *dptr,