shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-08-24 09:49:59 +03:00
Code Releases Activity

Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)

Browse Source 
The 'stats' variable was not initialized to NULL, so if some
early validation of the RPC call fails, it is possible to jump
to the 'cleanup' label and VIR_FREE an uninitialized pointer.
This is a security flaw, since the API can be called from a
readonly connection which can trigger the validation checks.

This was introduced in release v0.9.1 onwards by

  commit 158ba8730e
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Apr 13 16:21:35 2011 +0100

    Merge all returns paths from dispatcher into single path

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit e7f400a110)
This commit is contained in:
Daniel P. Berrange
2013-09-03 16:52:06 +01:00
committed by Eric Blake
parent 8616dc8b4f
commit 10d159fee2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
daemon/remote.c
View File

@ -1146,7 +1146,7 @@ remoteDispatchDomainMemoryStats(virNetServerPtr server ATTRIBUTE_UNUSED,
remote_domain_memory_stats_ret *ret) remote_domain_memory_stats_ret *ret)
{ {
virDomainPtr dom = NULL; virDomainPtr dom = NULL;
struct _virDomainMemoryStat *stats; struct _virDomainMemoryStat *stats = NULL;
int nr_stats; int nr_stats;
size_t i; size_t i;
int rv = -1; int rv = -1;