]> git.ipfire.org Git - thirdparty/libvirt.git/commitdiff
Really don't crash if a connection closes early CVE-2014-1447-2 v1.2.1-rc2
authorJiri Denemark <jdenemar@redhat.com>
Mon, 13 Jan 2014 14:46:24 +0000 (15:46 +0100)
committerJiri Denemark <jdenemar@redhat.com>
Mon, 13 Jan 2014 20:45:48 +0000 (21:45 +0100)
https://bugzilla.redhat.com/show_bug.cgi?id=1047577

When writing commit 173c291, I missed the fact virNetServerClientClose
unlocks the client object before actually clearing client->sock and thus
it is possible to hit a window when client->keepalive is NULL while
client->sock is not NULL. I was thinking client->sock == NULL was a
better check for a closed connection but apparently we have to go with
client->keepalive == NULL to actually fix the crash.

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
src/rpc/virnetserverclient.c

index 7830b7fff23dc3726fc03b1d77d6bc77705ce8ce..52b494129458aa626a098936fb6f0c8f24f60f55 100644 (file)
@@ -1546,7 +1546,7 @@ virNetServerClientStartKeepAlive(virNetServerClientPtr client)
     /* The connection might have been closed before we got here and thus the
      * keepalive object could have been removed too.
      */
-    if (!client->sock) {
+    if (!client->keepalive) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                        _("connection not open"));
         goto cleanup;