motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-19 08:02:15 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

vnc: clear vs->tlscreds after unparenting it

Browse source 
This pointer should be cleared in vnc_display_close()
otherwise a use-after-free can happen when when using the
old style 'x509' and 'tls' options rather than a persistent
tls-creds -object, by issuing monitor commands to change
the vnc server like so:

Start with: -vnc unix:test.socket,x509,tls
Then use the following monitor command:
  change vnc unix:test.socket

After this the pointer is still set but invalid and a crash
can be triggered for instance by issuing the same command a
second time which will try to object_unparent() the same
pointer again.

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Wolfgang Bumiller 2016-01-12 13:52:39 +01:00 • committed by Gerd Hoffmann
parent fba958c692
commit 67c4c2bd95
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
ui/vnc.c
View file

@ -3134,6 +3134,7 @@ static void vnc_display_close(VncDisplay *vs)
vs->subauth = VNC_AUTH_INVALID; vs->subauth = VNC_AUTH_INVALID;
if (vs->tlscreds) { if (vs->tlscreds) {
object_unparent(OBJECT(vs->tlscreds)); object_unparent(OBJECT(vs->tlscreds));
vs->tlscreds = NULL;
} }
g_free(vs->tlsaclname); g_free(vs->tlsaclname);
vs->tlsaclname = NULL; vs->tlsaclname = NULL;