External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-02 01:45:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

qemu_migration_cookie: Properly fetch cert DN

Browse Source 
If 1024 was not enough to fit the DN, gnutls_x509_crt_get_dn would store
the required size in subjectlen. And since we're not checking the return
value of this function, we would happily overwrite some random memory.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
This commit is contained in:
Jiri Denemark 2022-02-10 16:16:48 +01:00
parent d116f187c6
commit 3a311593e5
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/qemu/qemu_migration_cookie.c
View File

@ -180,12 +180,12 @@ static char *
qemuDomainExtractTLSSubject(const char *certdir) qemuDomainExtractTLSSubject(const char *certdir)
{ {
g_autofree char *certfile = NULL; g_autofree char *certfile = NULL;
char *subject = NULL; g_autofree char *subject = NULL;
g_autofree char *pemdata = NULL; g_autofree char *pemdata = NULL;
gnutls_datum_t pemdatum; gnutls_datum_t pemdatum;
gnutls_x509_crt_t cert; gnutls_x509_crt_t cert;
int rc; int rc;
size_t subjectlen; size_t subjectlen = 256;
certfile = g_strdup_printf("%s/server-cert.pem", certdir); certfile = g_strdup_printf("%s/server-cert.pem", certdir);
@ -214,13 +214,21 @@ qemuDomainExtractTLSSubject(const char *certdir)
return NULL; return NULL;
} }
subjectlen = 1024;
subject = g_new0(char, subjectlen + 1); subject = g_new0(char, subjectlen + 1);
rc = gnutls_x509_crt_get_dn(cert, subject, &subjectlen);
gnutls_x509_crt_get_dn(cert, subject, &subjectlen); if (rc == GNUTLS_E_SHORT_MEMORY_BUFFER) {
subject = g_realloc(subject, subjectlen + 1);
rc = gnutls_x509_crt_get_dn(cert, subject, &subjectlen);
}
if (rc != 0) {
virReportError(VIR_ERR_INTERNAL_ERROR,
_("cannot get cert distinguished name: %s"),
gnutls_strerror(rc));
return NULL;
}
subject[subjectlen] = '\0'; subject[subjectlen] = '\0';
return subject; return g_steal_pointer(&subject);
} }