From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33451) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y0ssz-0006HK-AY for qemu-devel@nongnu.org; Tue, 16 Dec 2014 09:14:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y0ssu-0004yH-F8 for qemu-devel@nongnu.org; Tue, 16 Dec 2014 09:14:01 -0500 Received: from mx1.redhat.com ([209.132.183.28]:51727) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y0ssu-0004y2-8F for qemu-devel@nongnu.org; Tue, 16 Dec 2014 09:13:56 -0500 From: Gerd Hoffmann Date: Tue, 16 Dec 2014 15:13:37 +0100 Message-Id: <1418739217-6561-7-git-send-email-kraxel@redhat.com> In-Reply-To: <1418739217-6561-1-git-send-email-kraxel@redhat.com> References: <1418739217-6561-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PULL 6/6] spice: fix memory leak List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gonglei , Gerd Hoffmann , Anthony Liguori From: Gonglei If errors happen for middle items of channel_list, qmp_query_spice_channels() returns NULL, and the variable cur_item going out of scope leaks the storage it points to. The flag is a compatibility thing for older spice-server versions. Meanwhile our minimum spice version requirement is new enough that we should never ever see this error, and if we do something went very seriously wrong. Let's using assert() instead of returning NULL to avoid a memory leak. Suggested-by: Paolo Bonzini Signed-off-by: Gonglei Reviewed-by: Eric Blake Signed-off-by: Gerd Hoffmann --- ui/spice-core.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/ui/spice-core.c b/ui/spice-core.c index 497670c..fe705c1 100644 --- a/ui/spice-core.c +++ b/ui/spice-core.c @@ -385,10 +385,7 @@ static SpiceChannelList *qmp_query_spice_channels(void) struct sockaddr *paddr; socklen_t plen; - if (!(item->info->flags & SPICE_CHANNEL_EVENT_FLAG_ADDR_EXT)) { - error_report("invalid channel event"); - return NULL; - } + assert(item->info->flags & SPICE_CHANNEL_EVENT_FLAG_ADDR_EXT); chan = g_malloc0(sizeof(*chan)); chan->value = g_malloc0(sizeof(*chan->value)); -- 1.8.3.1