]> git.ipfire.org Git - thirdparty/libvirt.git/commitdiff
Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296) CVE-2013-4296
authorDaniel P. Berrange <berrange@redhat.com>
Tue, 3 Sep 2013 15:52:06 +0000 (16:52 +0100)
committerEric Blake <eblake@redhat.com>
Wed, 18 Sep 2013 18:41:14 +0000 (12:41 -0600)
The 'stats' variable was not initialized to NULL, so if some
early validation of the RPC call fails, it is possible to jump
to the 'cleanup' label and VIR_FREE an uninitialized pointer.
This is a security flaw, since the API can be called from a
readonly connection which can trigger the validation checks.

This was introduced in release v0.9.1 onwards by

  commit 158ba8730e44b7dd07a21ab90499996c5dec080a
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Apr 13 16:21:35 2011 +0100

    Merge all returns paths from dispatcher into single path

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
daemon/remote.c

index 6b082cf1f62b441eb9bac27eec409eabd704ce9e..3ac528c6101a14f41b0f785d2961656d1b759613 100644 (file)
@@ -1146,7 +1146,7 @@ remoteDispatchDomainMemoryStats(virNetServerPtr server ATTRIBUTE_UNUSED,
                                 remote_domain_memory_stats_ret *ret)
 {
     virDomainPtr dom = NULL;
-    struct _virDomainMemoryStat *stats;
+    struct _virDomainMemoryStat *stats = NULL;
     int nr_stats;
     size_t i;
     int rv = -1;