From: Pramod Devendra <[email protected]>
Signed-off-by: Pramod Devendra <[email protected]>
CC: Ian Jackson <[email protected]>
CC: Stefano Stabellini <[email protected]>
CC: Ian Campbell <[email protected]>
CC: Wei Liu <[email protected]>
---
tools/libxl/libxl_qmp.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/tools/libxl/libxl_qmp.c b/tools/libxl/libxl_qmp.c
index c7324e6..992c1ee 100644
--- a/tools/libxl/libxl_qmp.c
+++ b/tools/libxl/libxl_qmp.c
@@ -365,14 +365,24 @@ static int qmp_open(libxl__qmp_handler *qmp, const char
*qmp_socket_path,
return -1;
}
ret = libxl_fd_set_nonblock(qmp->ctx, qmp->qmp_fd, 1);
- if (ret) return -1;
+ if (ret) {
+ close(qmp->qmp_fd);
+ return -1;
+ }
ret = libxl_fd_set_cloexec(qmp->ctx, qmp->qmp_fd, 1);
- if (ret) return -1;
+ if (ret) {
+ close(qmp->qmp_fd);
+ return -1;
+ }
+ if(sizeof (qmp->addr.sun_path) <= strlen(qmp_socket_path)) {
+ close(qmp->qmp_fd);
+ return -1;
+ }
memset(&qmp->addr, 0, sizeof (qmp->addr));
qmp->addr.sun_family = AF_UNIX;
strncpy(qmp->addr.sun_path, qmp_socket_path,
- sizeof (qmp->addr.sun_path));
+ sizeof (qmp->addr.sun_path)-1);
do {
ret = connect(qmp->qmp_fd, (struct sockaddr *) &qmp->addr,
@@ -384,6 +394,7 @@ static int qmp_open(libxl__qmp_handler *qmp, const char
*qmp_socket_path,
* ECONNREFUSED : Leftover socket hasn't been removed yet */
continue;
}
+ close(qmp->qmp_fd);
return -1;
} while ((++i / 5 <= timeout) && (usleep(200 * 1000) <= 0));
--
1.7.10.4
_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xen.org/xen-devel
