External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 13:45:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)

Browse Source 
The 'stats' variable was not initialized to NULL, so if some
early validation of the RPC call fails, it is possible to jump
to the 'cleanup' label and VIR_FREE an uninitialized pointer.
This is a security flaw, since the API can be called from a
readonly connection which can trigger the validation checks.

This was introduced in release v0.9.1 onwards by

  commit 158ba8730e
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Apr 13 16:21:35 2011 +0100

    Merge all returns paths from dispatcher into single path

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit e7f400a110)

Conflicts:
	daemon/remote.c - context
This commit is contained in:
Daniel P. Berrange 2013-09-03 16:52:06 +01:00 committed by Eric Blake
parent 77d448e15d
commit 455de1215c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
daemon/remote.c
View File

@ -1139,7 +1139,7 @@ remoteDispatchDomainMemoryStats(virNetServerPtr server ATTRIBUTE_UNUSED,
remote_domain_memory_stats_ret *ret) remote_domain_memory_stats_ret *ret)
{ {
virDomainPtr dom = NULL; virDomainPtr dom = NULL;
struct _virDomainMemoryStat *stats; struct _virDomainMemoryStat *stats = NULL;
int nr_stats, i; int nr_stats, i;
int rv = -1; int rv = -1;
struct daemonClientPrivate *priv = struct daemonClientPrivate *priv =