rpc: Fix crash on error paths of message dispatching

This patch resolves CVE-2013-0170:
https://bugzilla.redhat.com/show_bug.cgi?id=893450

When reading and dispatching of a message failed the message was freed
but wasn't removed from the message queue.

After that when the connection was about to be closed the pointer for
the message was still present in the queue and it was passed to
virNetMessageFree which tried to call the callback function from an
uninitialized pointer.

This patch removes the message from the queue before it's freed.

* rpc/virnetserverclient.c: virNetServerClientDispatchRead:
    - avoid use after free of RPC messages

diff --git a/src/rpc/virnetserverclient.c b/src/rpc/virnetserverclient.c
index af0560ed2dd84d0b8e3676073b6000da5f6d8926..446e1e91682fc626211bd5c3a25f9663d91449c5 100644 (file)
--- a/src/rpc/virnetserverclient.c
+++ b/src/rpc/virnetserverclient.c
@@ -987,6 +987,7 @@ readmore:
 
         /* Decode the header so we can use it for routing decisions */
         if (virNetMessageDecodeHeader(msg) < 0) {
+            virNetMessageQueueServe(&client->rx);
             virNetMessageFree(msg);
             client->wantClose = true;
             return;
@@ -996,6 +997,7 @@ readmore:
          * file descriptors */
         if (msg->header.type == VIR_NET_CALL_WITH_FDS &&
             virNetMessageDecodeNumFDs(msg) < 0) {
+            virNetMessageQueueServe(&client->rx);
             virNetMessageFree(msg);
             client->wantClose = true;
             return; /* Error */
@@ -1005,6 +1007,7 @@ readmore:
         for (i = msg->donefds ; i < msg->nfds ; i++) {
             int rv;
             if ((rv = virNetSocketRecvFD(client->sock, &(msg->fds[i]))) < 0) {
+                virNetMessageQueueServe(&client->rx);
                 virNetMessageFree(msg);
                 client->wantClose = true;
                 return;