In POST:
http://post-office.corp.redhat.com/archives/rhvirt-patches/2011-August/msg00147.html

This is already built into 0.9.4-1.el6 for RHEL 6.2.

Verified this bug with libvirt-0.9.4-2.el6.x86_64.
Test steps:
1. Edit /etc/libvirt/libvirtd.conf.
   set log_level = 1
   set log_outputs = "1:file:/tmp/libvirtd.log"
2. kill libvirtd process
    # kill `pidof libvirtd`
3. start libvirtd in foreground:
   # libvirtd
4. #virsh destroy test
   #virsh start test
   #grep 92dd267d-3ac5-4338-9d18-328cf3526a88 -i /tmp/libvirtd.log 
------
20:31:24.331: 3152: debug : virLockManagerLogParams:98 :   key=uuid type=uuid value=92dd267d-3ac5-4338-9d18-328cf3526a88
20:31:24.334: 3152: debug : virDomainFree:2144 : dom=0x7f936c110590, (VM: name=test, uuid=92dd267d-3ac5-4338-9d18-328cf3526a88), 
20:31:24.334: 3152: debug : virReleaseDomain:238 : release domain 0x7f936c110590 test 92dd267d-3ac5-4338-9d18-328cf3526a88
20:31:24.335: 3154: debug : virDomainLookupByUUID:1922 : conn=0x7f935c000a60, uuid=92dd267d-3ac5-4338-9d18-328cf3526a88
20:31:24.335: 3154: debug : virDomainFree:2144 : dom=0x7f9364007700, (VM: name=test, uuid=92dd267d-3ac5-4338-9d18-328cf3526a88), 
20:31:24.335: 3154: debug : virReleaseDomain:238 : release domain 0x7f9364007700 test 92dd267d-3ac5-4338-9d18-328cf3526a88
20:39:45.498: 3155: debug : virDomainFree:2144 : dom=0x7f93600008e0, (VM: name=test, uuid=92dd267d-3ac5-4338-9d18-328cf3526a88), 
------

Please help to confirm if these test steps are enough to verify this bug. Thanks!

(In reply to comment #7)
> Verified this bug with libvirt-0.9.4-2.el6.x86_64.
> Test steps:
> 1. Edit /etc/libvirt/libvirtd.conf.
>    set log_level = 1
>    set log_outputs = "1:file:/tmp/libvirtd.log"
> 2. kill libvirtd process
>     # kill `pidof libvirtd`
> 3. start libvirtd in foreground:
>    # libvirtd
> 4. #virsh destroy test
>    #virsh start test
>    #grep 92dd267d-3ac5-4338-9d18-328cf3526a88 -i /tmp/libvirtd.log 

That verifies that the log messages have sane uuids (the fix for bug 640202), but does not verify the NULL pointer dereference fixes (this bug).  To do that, you need to write a custom libvirt client that intentionally passes a NULL pointer for a UUID argument (not a valid use of the API, but the API is documented as detecting it as invalid).  The call should fail with invalid argument, but not crash, and the log should mention uuid=(null).

Here is such a demo program:

$ cat > demo.c <<EOF
#include <libvirt/libvirt.h>
#include <stdlib.h>

int main(void) {
  virInitialize();
  virDomainDestroy(NULL);
}

EOF

$ gcc -o demo -lvirt demo.c

This is what you should see for correct behaviour:

$ LIBVIRT_DEBUG=1 ./demo 2>&1 | grep Destroy
13:58:15.178: 11291: debug : virDomainDestroy:2049 : dom=(nil), (VM: name=(null), uuid=), 
libvir: Domain error : invalid domain pointer in virDomainDestroy

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Previously, when a debug process was being activated, the act of preparing a debug message ended up with dereferencing a UUID (universally unique identifier) prior to the NULL argument check. Consequently, an API running the debug process sometimes terminated with a segmentation fault. With this update, a patch has been provided to address this issue, and the crashes no longer occur in the described scenario.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1513.html