diff --git a/libvirt-0.6.3-event-handling-1.patch b/libvirt-0.6.3-event-handling-1.patch
new file mode 100644
index 0000000..4104a6b
--- /dev/null
+++ b/libvirt-0.6.3-event-handling-1.patch
@@ -0,0 +1,144 @@
+From e7be6cc841a5652b73ddd2ccd3769c7f8bbad13d Mon Sep 17 00:00:00 2001
+From: Daniel P. Berrange <berrange@redhat.com>
+Date: Tue, 12 May 2009 16:41:49 +0000
+Subject: [PATCH 1/2] Fix interrupting of main event thread & protect against accidental uniniitalized variables
+
+---
+ qemud/event.c | 42 +++++++++++++++++++++++++++++++++++-------
+ 1 files changed, 35 insertions(+), 7 deletions(-)
+
+diff --git a/qemud/event.c b/qemud/event.c
+index 65f548e..754f2b1 100644
+--- a/qemud/event.c
++++ b/qemud/event.c
+@@ -84,10 +84,10 @@ struct virEventLoop {
+ static struct virEventLoop eventLoop;
+
+ /* Unique ID for the next FD watch to be registered */
+-static int nextWatch = 0;
++static int nextWatch = 1;
+
+ /* Unique ID for the next timer to be registered */
+-static int nextTimer = 0;
++static int nextTimer = 1;
+
+ static void virEventLock(void)
+ {
+@@ -143,15 +143,22 @@ int virEventAddHandleImpl(int fd, int events,
+
+ void virEventUpdateHandleImpl(int watch, int events) {
+ int i;
++ EVENT_DEBUG("Update handle w=%d e=%d", watch, events);
++
++ if (watch <= 0) {
++ VIR_WARN("Ignoring invalid update watch %d", watch);
++ return;
++ }
++
+ virEventLock();
+ for (i = 0 ; i < eventLoop.handlesCount ; i++) {
+ if (eventLoop.handles[i].watch == watch) {
+ eventLoop.handles[i].events =
+ virEventHandleTypeToPollEvent(events);
++ virEventInterruptLocked();
+ break;
+ }
+ }
+- virEventInterruptLocked();
+ virEventUnlock();
+ }
+
+@@ -164,6 +171,12 @@ void virEventUpdateHandleImpl(int watch, int events) {
+ int virEventRemoveHandleImpl(int watch) {
+ int i;
+ EVENT_DEBUG("Remove handle %d", watch);
++
++ if (watch <= 0) {
++ VIR_WARN("Ignoring invalid remove watch %d", watch);
++ return -1;
++ }
++
+ virEventLock();
+ for (i = 0 ; i < eventLoop.handlesCount ; i++) {
+ if (eventLoop.handles[i].deleted)
+@@ -172,11 +185,11 @@ int virEventRemoveHandleImpl(int watch) {
+ if (eventLoop.handles[i].watch == watch) {
+ EVENT_DEBUG("mark delete %d %d", i, eventLoop.handles[i].fd);
+ eventLoop.handles[i].deleted = 1;
++ virEventInterruptLocked();
+ virEventUnlock();
+ return 0;
+ }
+ }
+- virEventInterruptLocked();
+ virEventUnlock();
+ return -1;
+ }
+@@ -232,6 +245,12 @@ void virEventUpdateTimeoutImpl(int timer, int frequency) {
+ struct timeval tv;
+ int i;
+ EVENT_DEBUG("Updating timer %d timeout with %d ms freq", timer, frequency);
++
++ if (timer <= 0) {
++ VIR_WARN("Ignoring invalid update timer %d", timer);
++ return;
++ }
++
+ if (gettimeofday(&tv, NULL) < 0) {
+ return;
+ }
+@@ -244,10 +263,10 @@ void virEventUpdateTimeoutImpl(int timer, int frequency) {
+ frequency >= 0 ? frequency +
+ (((unsigned long long)tv.tv_sec)*1000) +
+ (((unsigned long long)tv.tv_usec)/1000) : 0;
++ virEventInterruptLocked();
+ break;
+ }
+ }
+- virEventInterruptLocked();
+ virEventUnlock();
+ }
+
+@@ -260,6 +279,12 @@ void virEventUpdateTimeoutImpl(int timer, int frequency) {
+ int virEventRemoveTimeoutImpl(int timer) {
+ int i;
+ EVENT_DEBUG("Remove timer %d", timer);
++
++ if (timer <= 0) {
++ VIR_WARN("Ignoring invalid remove timer %d", timer);
++ return -1;
++ }
++
+ virEventLock();
+ for (i = 0 ; i < eventLoop.timeoutsCount ; i++) {
+ if (eventLoop.timeouts[i].deleted)
+@@ -267,11 +292,11 @@ int virEventRemoveTimeoutImpl(int timer) {
+
+ if (eventLoop.timeouts[i].timer == timer) {
+ eventLoop.timeouts[i].deleted = 1;
++ virEventInterruptLocked();
+ virEventUnlock();
+ return 0;
+ }
+ }
+- virEventInterruptLocked();
+ virEventUnlock();
+ return -1;
+ }
+@@ -617,9 +642,12 @@ static int virEventInterruptLocked(void)
+ char c = '\0';
+
+ if (!eventLoop.running ||
+- pthread_self() == eventLoop.leader)
++ pthread_self() == eventLoop.leader) {
++ VIR_DEBUG("Skip interrupt, %d %d", eventLoop.running, (int)eventLoop.leader);
+ return 0;
++ }
+
++ VIR_DEBUG0("Interrupting");
+ if (safewrite(eventLoop.wakeupfd[1], &c, sizeof(c)) != sizeof(c))
+ return -1;
+ return 0;
+--
+1.6.0.6
+
diff --git a/libvirt-0.6.3-event-handling-2.patch b/libvirt-0.6.3-event-handling-2.patch
new file mode 100644
index 0000000..ddcede6
--- /dev/null
+++ b/libvirt-0.6.3-event-handling-2.patch
@@ -0,0 +1,197 @@
+From 6483ee77ed12f037d68a6adc690624fa1b508dc0 Mon Sep 17 00:00:00 2001
+From: Daniel P. Berrange <berrange@redhat.com>
+Date: Tue, 12 May 2009 16:43:04 +0000
+Subject: [PATCH 2/2] Fix watch/timer event deletion
+
+---
+ qemud/event.c | 112 ++++++++++++++++++++++++++-------------------------------
+ 1 files changed, 51 insertions(+), 61 deletions(-)
+
+diff --git a/qemud/event.c b/qemud/event.c
+index 754f2b1..a57d967 100644
+--- a/qemud/event.c
++++ b/qemud/event.c
+@@ -313,7 +313,7 @@ static int virEventCalculateTimeout(int *timeout) {
+ EVENT_DEBUG("Calculate expiry of %d timers", eventLoop.timeoutsCount);
+ /* Figure out if we need a timeout */
+ for (i = 0 ; i < eventLoop.timeoutsCount ; i++) {
+- if (eventLoop.timeouts[i].deleted || eventLoop.timeouts[i].frequency < 0)
++ if (eventLoop.timeouts[i].frequency < 0)
+ continue;
+
+ EVENT_DEBUG("Got a timeout scheduled for %llu", eventLoop.timeouts[i].expiresAt);
+@@ -350,32 +350,26 @@ static int virEventCalculateTimeout(int *timeout) {
+ * file handles. The caller must free the returned data struct
+ * returns: the pollfd array, or NULL on error
+ */
+-static int virEventMakePollFDs(struct pollfd **retfds) {
++static struct pollfd *virEventMakePollFDs(void) {
+ struct pollfd *fds;
+- int i, nfds = 0;
++ int i;
+
+- for (i = 0 ; i < eventLoop.handlesCount ; i++) {
+- if (eventLoop.handles[i].deleted)
+- continue;
+- nfds++;
+- }
+- *retfds = NULL;
+ /* Setup the poll file handle data structs */
+- if (VIR_ALLOC_N(fds, nfds) < 0)
+- return -1;
++ if (VIR_ALLOC_N(fds, eventLoop.handlesCount) < 0)
++ return NULL;
+
+- for (i = 0, nfds = 0 ; i < eventLoop.handlesCount ; i++) {
+- if (eventLoop.handles[i].deleted)
+- continue;
+- fds[nfds].fd = eventLoop.handles[i].fd;
+- fds[nfds].events = eventLoop.handles[i].events;
+- fds[nfds].revents = 0;
++ for (i = 0 ; i < eventLoop.handlesCount ; i++) {
++ EVENT_DEBUG("Prepare n=%d w=%d, f=%d e=%d", i,
++ eventLoop.handles[i].watch,
++ eventLoop.handles[i].fd,
++ eventLoop.handles[i].events);
++ fds[i].fd = eventLoop.handles[i].fd;
++ fds[i].events = eventLoop.handles[i].events;
++ fds[i].revents = 0;
+ //EVENT_DEBUG("Wait for %d %d", eventLoop.handles[i].fd, eventLoop.handles[i].events);
+- nfds++;
+ }
+
+- *retfds = fds;
+- return nfds;
++ return fds;
+ }
+
+
+@@ -435,26 +429,30 @@ static int virEventDispatchTimeouts(void) {
+ * Returns 0 upon success, -1 if an error occurred
+ */
+ static int virEventDispatchHandles(int nfds, struct pollfd *fds) {
+- int i, n;
++ int i;
+
+- for (i = 0, n = 0 ; i < eventLoop.handlesCount && n < nfds ; i++) {
++ /* NB, use nfds not eventLoop.handlesCount, because new
++ * fds might be added on end of list, and they're not
++ * in the fds array we've got */
++ for (i = 0 ; i < nfds ; i++) {
+ if (eventLoop.handles[i].deleted) {
+- EVENT_DEBUG("Skip deleted %d", eventLoop.handles[i].fd);
++ EVENT_DEBUG("Skip deleted n=%d w=%d f=%d", i,
++ eventLoop.handles[i].watch, eventLoop.handles[i].fd);
+ continue;
+ }
+
+- if (fds[n].revents) {
++ if (fds[i].revents) {
+ virEventHandleCallback cb = eventLoop.handles[i].cb;
+ void *opaque = eventLoop.handles[i].opaque;
+- int hEvents = virPollEventToEventHandleType(fds[n].revents);
+- EVENT_DEBUG("Dispatch %d %d %p", fds[n].fd,
+- fds[n].revents, eventLoop.handles[i].opaque);
++ int hEvents = virPollEventToEventHandleType(fds[i].revents);
++ EVENT_DEBUG("Dispatch n=%d f=%d w=%d e=%d %p", i,
++ fds[i].fd, eventLoop.handles[i].watch,
++ fds[i].revents, eventLoop.handles[i].opaque);
+ virEventUnlock();
+ (cb)(eventLoop.handles[i].watch,
+- fds[n].fd, hEvents, opaque);
++ fds[i].fd, hEvents, opaque);
+ virEventLock();
+ }
+- n++;
+ }
+
+ return 0;
+@@ -545,22 +543,21 @@ static int virEventCleanupHandles(void) {
+ * at least one file handle has an event, or a timer expires
+ */
+ int virEventRunOnce(void) {
+- struct pollfd *fds;
++ struct pollfd *fds = NULL;
+ int ret, timeout, nfds;
+
+ virEventLock();
+ eventLoop.running = 1;
+ eventLoop.leader = pthread_self();
+- if ((nfds = virEventMakePollFDs(&fds)) < 0) {
+- virEventUnlock();
+- return -1;
+- }
+
+- if (virEventCalculateTimeout(&timeout) < 0) {
+- VIR_FREE(fds);
+- virEventUnlock();
+- return -1;
+- }
++ if (virEventCleanupTimeouts() < 0 ||
++ virEventCleanupHandles() < 0)
++ goto error;
++
++ if (!(fds = virEventMakePollFDs()) ||
++ virEventCalculateTimeout(&timeout) < 0)
++ goto error;
++ nfds = eventLoop.handlesCount;
+
+ virEventUnlock();
+
+@@ -572,38 +569,31 @@ int virEventRunOnce(void) {
+ if (errno == EINTR) {
+ goto retry;
+ }
+- VIR_FREE(fds);
+- return -1;
++ goto error_unlocked;
+ }
+
+ virEventLock();
+- if (virEventDispatchTimeouts() < 0) {
+- VIR_FREE(fds);
+- virEventUnlock();
+- return -1;
+- }
++ if (virEventDispatchTimeouts() < 0)
++ goto error;
+
+ if (ret > 0 &&
+- virEventDispatchHandles(nfds, fds) < 0) {
+- VIR_FREE(fds);
+- virEventUnlock();
+- return -1;
+- }
+- VIR_FREE(fds);
+-
+- if (virEventCleanupTimeouts() < 0) {
+- virEventUnlock();
+- return -1;
+- }
++ virEventDispatchHandles(nfds, fds) < 0)
++ goto error;
+
+- if (virEventCleanupHandles() < 0) {
+- virEventUnlock();
+- return -1;
+- }
++ if (virEventCleanupTimeouts() < 0 ||
++ virEventCleanupHandles() < 0)
++ goto error;
+
+ eventLoop.running = 0;
+ virEventUnlock();
++ VIR_FREE(fds);
+ return 0;
++
++error:
++ virEventUnlock();
++error_unlocked:
++ VIR_FREE(fds);
++ return -1;
+ }
+
+ static void virEventHandleWakeup(int watch ATTRIBUTE_UNUSED,
+--
+1.6.0.6
+
diff --git a/libvirt-0.6.3-xml-attribute-escaping.patch b/libvirt-0.6.3-xml-attribute-escaping.patch
new file mode 100644
index 0000000..5c9ecf5
--- /dev/null
+++ b/libvirt-0.6.3-xml-attribute-escaping.patch
@@ -0,0 +1,47 @@
+From 7f7a4403860f56d5a1ad65bfd16f5bf97a971d45 Mon Sep 17 00:00:00 2001
+From: Daniel Veillard <veillard@redhat.com>
+Date: Wed, 13 May 2009 16:19:59 +0000
+Subject: [PATCH 1/1] * src/buf.c: avoid an XML attribute escaping bug #499791
+ daniel
+
+---
+ src/buf.c | 16 +++++++++++++++-
+ 1 files changed, 15 insertions(+), 1 deletions(-)
+
+diff --git a/src/buf.c b/src/buf.c
+index cdcdac9..259175d 100644
+--- a/src/buf.c
++++ b/src/buf.c
+@@ -266,7 +266,7 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st
+ return;
+
+ len = strlen(str);
+- if (VIR_ALLOC_N(escaped, 5 * len + 1) < 0) {
++ if (VIR_ALLOC_N(escaped, 6 * len + 1) < 0) {
+ virBufferNoMemory(buf);
+ return;
+ }
+@@ -290,6 +290,20 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st
+ *out++ = 'm';
+ *out++ = 'p';
+ *out++ = ';';
++ } else if (*cur == '"') {
++ *out++ = '&';
++ *out++ = 'q';
++ *out++ = 'u';
++ *out++ = 'o';
++ *out++ = 't';
++ *out++ = ';';
++ } else if (*cur == '\'') {
++ *out++ = '&';
++ *out++ = 'a';
++ *out++ = 'p';
++ *out++ = 'o';
++ *out++ = 's';
++ *out++ = ';';
+ } else if ((*cur >= 0x20) || (*cur == '\n') || (*cur == '\t') ||
+ (*cur == '\r')) {
+ /*
+--
+1.6.0.6
+
diff --git a/libvirt.spec b/libvirt.spec
index 62d43bb..5a254cd 100644
--- a/libvirt.spec
+++ b/libvirt.spec
@@ -55,7 +55,7 @@
Summary: Library providing a simple API virtualization
Name: libvirt
Version: 0.6.3
-Release: 9%{?dist}%{?extra_release}
+Release: 10%{?dist}%{?extra_release}
License: LGPLv2+
Group: Development/Libraries
Source: libvirt-%{version}.tar.gz
@@ -74,6 +74,11 @@ Patch4: libvirt-0.6.3-enable-qemu-0-10-migration.patch
Patch5: libvirt-0.6.2-fix-nosource-label.patch
# Fix qemu argv detection with latest qemu (bz 501923)
Patch6: libvirt-0.6.3-fix-qemu-argv-detection-with-kvm-85.patch
+# Fix XML attribute escaping (bz 499791)
+Patch7: libvirt-0.6.3-xml-attribute-escaping.patch
+# Fix serious event handling issues causing guests to be destroyed (bz 499698)
+Patch8: libvirt-0.6.3-event-handling-1.patch
+Patch9: libvirt-0.6.3-event-handling-2.patch
# Patches not for upstream.
@@ -235,6 +240,9 @@ of recent versions of Linux (and other OSes).
%patch4 -p1
%patch5 -p1
%patch6 -p1
+%patch7 -p1
+%patch8 -p1
+%patch9 -p1
%patch200 -p0
@@ -565,6 +573,10 @@ fi
%endif
%changelog
+* Thu May 21 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.3-10.fc12
+- Fix XML attribute escaping (bug #499791)
+- Fix serious event handling issues causing guests to be destroyed (bug #499698)
+
* Thu May 21 2009 Mark McLoughlin <markmc@redhat.com> - 0.6.3-9.fc12
- Fix qemu argv detection with latest qemu (bug #501923)