Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)
authorDaniel P. Berrange <berrange@redhat.com>
Tue, 3 Sep 2013 15:52:06 +0000 (16:52 +0100)
committerEric Blake <eblake@redhat.com>
Thu, 19 Sep 2013 03:10:27 +0000 (21:10 -0600)
commit2f34eae93a09ac94297eaa91ad8f4b037b2c9e27
tree57eff9dac99b48ee9902cada5f223f6427fa1728
parent078627104d338b8de18156a7162d9b19378c5e88
Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)

The 'stats' variable was not initialized to NULL, so if some
early validation of the RPC call fails, it is possible to jump
to the 'cleanup' label and VIR_FREE an uninitialized pointer.
This is a security flaw, since the API can be called from a
readonly connection which can trigger the validation checks.

This was introduced in release v0.9.1 onwards by

  commit 158ba8730e44b7dd07a21ab90499996c5dec080a
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Apr 13 16:21:35 2011 +0100

    Merge all returns paths from dispatcher into single path

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit e7f400a110e2e3673b96518170bfea0855dd82c0)

Conflicts:
daemon/remote.c - context
daemon/remote.c