|
 |
43fe83 |
From aa873cb5be6c95c8a7ae95680759dcb0f90f57bb Mon Sep 17 00:00:00 2001
|
|
|
43fe83 |
Message-Id: <aa873cb5be6c95c8a7ae95680759dcb0f90f57bb.1380112456.git.jdenemar@redhat.com>
|
|
|
43fe83 |
From: "Daniel P. Berrange" <berrange@redhat.com>
|
|
|
43fe83 |
Date: Tue, 3 Sep 2013 16:52:06 +0100
|
|
|
43fe83 |
Subject: [PATCH] Fix crash in remoteDispatchDomainMemoryStats
|
|
|
43fe83 |
|
|
|
43fe83 |
CVE-2013-4296
|
|
|
43fe83 |
|
|
|
43fe83 |
The 'stats' variable was not initialized to NULL, so if some
|
|
|
43fe83 |
early validation of the RPC call fails, it is possible to jump
|
|
|
43fe83 |
to the 'cleanup' label and VIR_FREE an uninitialized pointer.
|
|
|
43fe83 |
This is a security flaw, since the API can be called from a
|
|
|
43fe83 |
readonly connection which can trigger the validation checks.
|
|
|
43fe83 |
|
|
|
43fe83 |
This was introduced in release v0.9.1 onwards by
|
|
|
43fe83 |
|
|
|
43fe83 |
commit 158ba8730e44b7dd07a21ab90499996c5dec080a
|
|
|
43fe83 |
Author: Daniel P. Berrange <berrange@redhat.com>
|
|
|
43fe83 |
Date: Wed Apr 13 16:21:35 2011 +0100
|
|
|
43fe83 |
|
|
|
43fe83 |
Merge all returns paths from dispatcher into single path
|
|
|
43fe83 |
|
|
|
43fe83 |
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
|
|
|
43fe83 |
(cherry picked from commit e7f400a110e2e3673b96518170bfea0855dd82c0)
|
|
|
43fe83 |
---
|
|
|
43fe83 |
daemon/remote.c | 2 +-
|
|
|
43fe83 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
43fe83 |
|
|
|
43fe83 |
diff --git a/daemon/remote.c b/daemon/remote.c
|
|
|
43fe83 |
index b5395dd..afd9fb5 100644
|
|
|
43fe83 |
--- a/daemon/remote.c
|
|
|
43fe83 |
+++ b/daemon/remote.c
|
|
|
43fe83 |
@@ -1146,7 +1146,7 @@ remoteDispatchDomainMemoryStats(virNetServerPtr server ATTRIBUTE_UNUSED,
|
|
|
43fe83 |
remote_domain_memory_stats_ret *ret)
|
|
|
43fe83 |
{
|
|
|
43fe83 |
virDomainPtr dom = NULL;
|
|
|
43fe83 |
- struct _virDomainMemoryStat *stats;
|
|
|
43fe83 |
+ struct _virDomainMemoryStat *stats = NULL;
|
|
|
43fe83 |
int nr_stats;
|
|
|
43fe83 |
size_t i;
|
|
|
43fe83 |
int rv = -1;
|
|
|
43fe83 |
--
|
|
|
43fe83 |
1.8.3.2
|
|
|
43fe83 |
|