On 26/06/2016 00:15, Eric Blake wrote:
> 
> +/* Send an error reply.
> + * Return -errno to kill connection, 0 to continue negotiation. */
> +static int GCC_FMT_ATTR(4, 5)
> +    nbd_negotiate_send_rep_err(QIOChannel *ioc, uint32_t type,
> +                               uint32_t opt, const char *fmt, ...)
> +{
> +    va_list va;
> +    char *msg;
> +    int ret;
> +    size_t len;
> +
> +    va_start(va, fmt);
> +    msg = g_strdup_vprintf(fmt, va);

This leaks below.

Paolo

> +    va_end(va);
> +    len = strlen(msg);
> +    assert(len < 4096);
> +    TRACE("sending error message \"%s\"", msg);
> +    ret = nbd_negotiate_send_rep_len(ioc, type, opt, len);
> +    if (ret < 0) {
> +        return ret;
> +    }
> +    if (nbd_negotiate_write(ioc, msg, len) != len) {
> +        LOG("write failed (error message)");
> +        return -EINVAL;
> +    }
> +    return 0;

Reply via email to