External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-18 10:35:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)

Browse Source 
The 'stats' variable was not initialized to NULL, so if some
early validation of the RPC call fails, it is possible to jump
to the 'cleanup' label and VIR_FREE an uninitialized pointer.
This is a security flaw, since the API can be called from a
readonly connection which can trigger the validation checks.

This was introduced in release v0.9.1 onwards by

  commit 158ba8730e44b7dd07a21ab90499996c5dec080a
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Apr 13 16:21:35 2011 +0100

    Merge all returns paths from dispatcher into single path

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit e7f400a110e2e3673b96518170bfea0855dd82c0)

Conflicts:
	daemon/remote.c - context
This commit is contained in:
Daniel P. Berrange 2013-09-03 16:52:06 +01:00 committed by Eric Blake
parent c7df5ed8d8
commit a413bc2dda
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
daemon/remote.c
View File

@ -1165,7 +1165,7 @@ remoteDispatchDomainMemoryStats(virNetServerPtr server ATTRIBUTE_UNUSED,
remote_domain_memory_stats_ret *ret)
{
virDomainPtr dom = NULL;
struct _virDomainMemoryStat *stats;
struct _virDomainMemoryStat *stats = NULL;
int nr_stats, i;
int rv = -1;
struct daemonClientPrivate *priv =