[libvirt] [PATCH] Fix possible invalid read in adminClientGetInfo
virNetServerClientGetInfo returns the client's remote address
as a string, which is a part of the client object.
Use VIR_STRDUP to make a copy which can be freely accessed
even after the virNetServerClient object is unlocked.
---
daemon/admin_server.c | 3 ++-
src/rpc/virnetserverclient.c | 8 ++++++--
src/rpc/virnetserverclient.h | 2 +-
3 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/daemon/admin_server.c b/daemon/admin_server.c
index cb9079c..9f24f68 100644
--- a/daemon/admin_server.c
+++ b/daemon/admin_server.c
@@ -221,7 +221,7 @@ adminClientGetInfo(virNetServerClientPtr client,
int ret = -1;
int maxparams = 0;
bool readonly;
- const char *sock_addr = NULL;
+ char *sock_addr = NULL;
const char *attr = NULL;
virTypedParameterPtr tmpparams = NULL;
virIdentityPtr identity = NULL;
@@ -300,6 +300,7 @@ adminClientGetInfo(virNetServerClientPtr client,
cleanup:
virObjectUnref(identity);
+ VIR_FREE(sock_addr);
return ret;
}
diff --git a/src/rpc/virnetserverclient.c b/src/rpc/virnetserverclient.c
index 39fe860..81da82c 100644
--- a/src/rpc/virnetserverclient.c
+++ b/src/rpc/virnetserverclient.c
@@ -1606,20 +1606,24 @@ virNetServerClientGetTransport(virNetServerClientPtr client)
int
virNetServerClientGetInfo(virNetServerClientPtr client,
- bool *readonly, const char **sock_addr,
+ bool *readonly, char **sock_addr,
virIdentityPtr *identity)
{
int ret = -1;
+ const char *addr;
virObjectLock(client);
*readonly = client->readonly;
- if (!(*sock_addr = virNetServerClientRemoteAddrStringURI(client))) {
+ if (!(addr = virNetServerClientRemoteAddrStringURI(client))) {
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
_("No network socket associated with client"));
goto cleanup;
}
+ if (VIR_STRDUP(*sock_addr, addr) < 0)
+ goto cleanup;
+
if (!client->identity) {
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
_("No identity information available for client"));
diff --git a/src/rpc/virnetserverclient.h b/src/rpc/virnetserverclient.h
index c243a68..a53cc00 100644
--- a/src/rpc/virnetserverclient.h
+++ b/src/rpc/virnetserverclient.h
@@ -149,7 +149,7 @@ bool virNetServerClientNeedAuth(virNetServerClientPtr client);
int virNetServerClientGetTransport(virNetServerClientPtr client);
int virNetServerClientGetInfo(virNetServerClientPtr client,
- bool *readonly, const char **sock_addr,
+ bool *readonly, char **sock_addr,
virIdentityPtr *identity);
#endif /* __VIR_NET_SERVER_CLIENT_H__ */
--
2.7.3