File 9bf9e0ae-CVE-2020-12430.patch of Package libvirt.22291
commit 9bf9e0ae6af38c806f4672ca7b12a6b38d5a9581
Author: Peter Krempa <pkrempa@redhat.com>
Date: Wed Feb 19 08:40:59 2020 +0100
qemuDomainGetStatsIOThread: Don't leak array with 0 iothreads
qemuMonitorGetIOThreads returns a NULL-terminated list even when 0
iothreads are present. The caller didn't perform cleanup if there were 0
iothreads leaking the array.
https://bugzilla.redhat.com/show_bug.cgi?id=1804548
Fixes: d1eac92784573559b6fd56836e33b215c89308e3
Reported-by: Jing Yan <jiyan@redhat.com>
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Index: libvirt-6.0.0/src/qemu/qemu_driver.c
===================================================================
--- libvirt-6.0.0.orig/src/qemu/qemu_driver.c
+++ libvirt-6.0.0/src/qemu/qemu_driver.c
@@ -21511,8 +21511,12 @@ qemuDomainGetStatsIOThread(virQEMUDriver
if ((niothreads = qemuDomainGetIOThreadsMon(driver, dom, &iothreads)) < 0)
return -1;
- if (niothreads == 0)
- return 0;
+ /* qemuDomainGetIOThreadsMon returns a NULL-terminated list, so we must free
+ * it even if it returns 0 */
+ if (niothreads == 0) {
+ ret = 0;
+ goto cleanup;
+ }
if (virTypedParamListAddUInt(params, niothreads, "iothread.count") < 0)
goto cleanup;