External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-21 12:05:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

rpc: Fix crash on error paths of message dispatching

Browse Source 
This patch resolves CVE-2013-0170:
https://bugzilla.redhat.com/show_bug.cgi?id=893450

When reading and dispatching of a message failed the message was freed
but wasn't removed from the message queue.

After that when the connection was about to be closed the pointer for
the message was still present in the queue and it was passed to
virNetMessageFree which tried to call the callback function from an
uninitialized pointer.

This patch removes the message from the queue before it's freed.

* rpc/virnetserverclient.c: virNetServerClientDispatchRead:
    - avoid use after free of RPC messages
(cherry picked from commit 46532e3e8ed5f5a736a02f67d6c805492f9ca720)
This commit is contained in:
Peter Krempa 2013-01-04 16:15:04 +01:00
parent 6b3edda207
commit d0e1501518
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/rpc/virnetserverclient.c
View File

@ -823,6 +823,7 @@ readmore:
/* Decode the header so we can use it for routing decisions */ /* Decode the header so we can use it for routing decisions */
if (virNetMessageDecodeHeader(msg) < 0) { if (virNetMessageDecodeHeader(msg) < 0) {
virNetMessageQueueServe(&client->rx);
virNetMessageFree(msg); virNetMessageFree(msg);
client->wantClose = true; client->wantClose = true;
return; return;
@ -832,6 +833,7 @@ readmore:
* file descriptors */ * file descriptors */
if (msg->header.type == VIR_NET_CALL_WITH_FDS && if (msg->header.type == VIR_NET_CALL_WITH_FDS &&
virNetMessageDecodeNumFDs(msg) < 0) { virNetMessageDecodeNumFDs(msg) < 0) {
virNetMessageQueueServe(&client->rx);
virNetMessageFree(msg); virNetMessageFree(msg);
client->wantClose = true; client->wantClose = true;
return; /* Error */ return; /* Error */
@ -841,6 +843,7 @@ readmore:
for (i = msg->donefds ; i < msg->nfds ; i++) { for (i = msg->donefds ; i < msg->nfds ; i++) {
int rv; int rv;
if ((rv = virNetSocketRecvFD(client->sock, &(msg->fds[i]))) < 0) { if ((rv = virNetSocketRecvFD(client->sock, &(msg->fds[i]))) < 0) {
virNetMessageQueueServe(&client->rx);
virNetMessageFree(msg); virNetMessageFree(msg);
client->wantClose = true; client->wantClose = true;
return; return;