On 12/13/2011 06:32 AM, Osier Yang wrote:
> ---
>  python/generator.py             |    1 +
>  python/libvirt-override-api.xml |    9 +++++++++
>  python/libvirt-override.c       |   35 +++++++++++++++++++++++++++++++++++
>  3 files changed, 45 insertions(+), 0 deletions(-)
> 

> +
> +    if ((buf = malloc(size)) == NULL)
> +        return VIR_PY_NONE;
> +
> +    LIBVIRT_BEGIN_ALLOW_THREADS;
> +    c_retval = virDomainBlockPeek(domain, disk, offset, size, buf, flags);
> +    LIBVIRT_END_ALLOW_THREADS;
> +
> +    if (c_retval < 0)
> +        return VIR_PY_NONE;

Memory leak.  Free buf on this error path.

> +
> +    py_retval = libvirt_charPtrWrap(buf);
> +    return py_retval;
> +}

Wrong.  buf may contain embedded NUL, and/or not be NUL-terminated, but
PyString_FromString copies its argument up to the NUL byte, meaning you
leaked buf, and either truncated or had a buffer overrun in the
resulting python object.

You need to return a python object that represents an array of bytes (of
length determined by the input argument), and NOT a generic string.

-- 
Eric Blake   ebl...@redhat.com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

Attachment: signature.asc
Description: OpenPGP digital signature

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Reply via email to