|
 |
c401cc |
From bfe11034e00fd8e328fdc9194a753063ec53ce10 Mon Sep 17 00:00:00 2001
|
|
|
c401cc |
Message-Id: <bfe11034e00fd8e328fdc9194a753063ec53ce10.1390394206.git.jdenemar@redhat.com>
|
|
|
c401cc |
From: Jiri Denemark <jdenemar@redhat.com>
|
|
|
c401cc |
Date: Mon, 13 Jan 2014 15:46:24 +0100
|
|
|
c401cc |
Subject: [PATCH] Really don't crash if a connection closes early
|
|
|
c401cc |
|
|
|
c401cc |
CVE-2014-1447
|
|
|
c401cc |
|
|
|
c401cc |
When writing commit 173c291, I missed the fact virNetServerClientClose
|
|
|
c401cc |
unlocks the client object before actually clearing client->sock and thus
|
|
|
c401cc |
it is possible to hit a window when client->keepalive is NULL while
|
|
|
c401cc |
client->sock is not NULL. I was thinking client->sock == NULL was a
|
|
|
c401cc |
better check for a closed connection but apparently we have to go with
|
|
|
c401cc |
client->keepalive == NULL to actually fix the crash.
|
|
|
c401cc |
|
|
|
c401cc |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
c401cc |
(cherry picked from commit 066c8ef6c18bc1faf8b3e10787b39796a7a06cc0)
|
|
|
c401cc |
---
|
|
|
c401cc |
src/rpc/virnetserverclient.c | 2 +-
|
|
|
c401cc |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
c401cc |
|
|
|
c401cc |
diff --git a/src/rpc/virnetserverclient.c b/src/rpc/virnetserverclient.c
|
|
|
c401cc |
index 64e91d3..56ca23b 100644
|
|
|
c401cc |
--- a/src/rpc/virnetserverclient.c
|
|
|
c401cc |
+++ b/src/rpc/virnetserverclient.c
|
|
|
c401cc |
@@ -1540,7 +1540,7 @@ virNetServerClientStartKeepAlive(virNetServerClientPtr client)
|
|
|
c401cc |
/* The connection might have been closed before we got here and thus the
|
|
|
c401cc |
* keepalive object could have been removed too.
|
|
|
c401cc |
*/
|
|
|
c401cc |
- if (!client->sock) {
|
|
|
c401cc |
+ if (!client->keepalive) {
|
|
|
c401cc |
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
|
|
|
c401cc |
_("connection not open"));
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
--
|
|
|
c401cc |
1.8.5.3
|
|
|
c401cc |
|