security: Fix libvirtd crash possibility

Fix for CVE-2012-4423.

When generating RPC protocol messages, it's strictly needed to have a
continuous line of numbers or RPC messages. However in case anyone
tries backporting some functionality and will skip a number, there is
a possibility to make the daemon segfault with newer virsh (version of
the library, rpc call, etc.) even unintentionally.

The problem is that the skipped numbers will get func filled with
NULLs, but there is no check whether these are set before the daemon
tries to run them. This patch very simply enhances one check and fixes
that.
(cherry picked from commit b7ff9e696063189a715802d081d55a398663c15a)

diff --git a/AUTHORS b/AUTHORS
index cea6ebd45ed862b50b3402a1cb69a5d15b274fb8..d85112ec7e6a55647ad5af30f0edfe4193a90bff 100644 (file)
--- a/AUTHORS
+++ b/AUTHORS
@@ -197,6 +197,7 @@ Patches have also been contributed by:
   Matthias Witte       <witte@netzquadrat.de>
   Radu Caragea         <dmns_serp@yahoo.com>
   Stefan Bader         <stefan.bader@canonical.com>
+  Martin Kletzander    <mkletzan@redhat.com>
 
   [....send patches to get your name here....]
 

diff --git a/src/rpc/virnetserverprogram.c b/src/rpc/virnetserverprogram.c
index 334a0bf7a5da0ea24d0f8373ce0e2502b3522ee0..13bf3fcab7e7565b3bc72c2980e1c8f40a6214d2 100644 (file)
--- a/src/rpc/virnetserverprogram.c
+++ b/src/rpc/virnetserverprogram.c
@@ -1,7 +1,7 @@
 /*
  * virnetserverprogram.c: generic network RPC server program
  *
- * Copyright (C) 2006-2011 Red Hat, Inc.
+ * Copyright (C) 2006-2012 Red Hat, Inc.
  * Copyright (C) 2006 Daniel P. Berrange
  *
  * This library is free software; you can redistribute it and/or
@@ -100,12 +100,19 @@ int virNetServerProgramMatches(virNetServerProgramPtr prog,
 static virNetServerProgramProcPtr virNetServerProgramGetProc(virNetServerProgramPtr prog,
                                                              int procedure)
 {
+    virNetServerProgramProcPtr proc;
+
     if (procedure < 0)
         return NULL;
     if (procedure >= prog->nprocs)
         return NULL;
 
-    return &prog->procs[procedure];
+    proc = &prog->procs[procedure];
+
+    if (!proc->func)
+        return NULL;
+
+    return proc;
 }
 
 unsigned int