|
 |
cd9d16 |
From fa9ad46e1a4b3707a465bccf6f4431db7a647a08 Mon Sep 17 00:00:00 2001
|
|
|
cd9d16 |
From: Markus Armbruster <armbru@redhat.com>
|
|
|
cd9d16 |
Date: Fri, 28 Oct 2011 17:07:02 +0200
|
|
|
cd9d16 |
Subject: [PATCH] acl: Fix use after free in qemu_acl_reset()
|
|
|
cd9d16 |
MIME-Version: 1.0
|
|
|
cd9d16 |
Content-Type: text/plain; charset=UTF-8
|
|
|
cd9d16 |
Content-Transfer-Encoding: 8bit
|
|
|
cd9d16 |
|
|
|
cd9d16 |
Reproducer:
|
|
|
cd9d16 |
|
|
|
cd9d16 |
$ MALLOC_PERTURB_=234 qemu-system-x86_64 -vnc :0,acl,sasl [...]
|
|
|
cd9d16 |
QEMU 0.15.50 monitor - type 'help' for more information
|
|
|
cd9d16 |
(qemu) acl_add vnc.username fred allow
|
|
|
cd9d16 |
acl: added rule at position 1
|
|
|
cd9d16 |
(qemu) acl_reset vnc.username
|
|
|
cd9d16 |
Segmentation fault (core dumped)
|
|
|
cd9d16 |
|
|
|
cd9d16 |
Spotted by Coverity.
|
|
|
cd9d16 |
|
|
|
cd9d16 |
Signed-off-by: Markus Armbruster <armbru@redhat.com>
|
|
|
cd9d16 |
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
|
|
|
cd9d16 |
(cherry picked from commit 0ce6a434176e274a7e86bcaa268542c5cc402696)
|
|
|
cd9d16 |
|
|
|
cd9d16 |
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
|
cd9d16 |
Signed-off-by: Andreas Färber <afaerber@suse.de>
|
|
|
cd9d16 |
---
|
|
|
cd9d16 |
acl.c | 4 ++--
|
|
|
cd9d16 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
cd9d16 |
|
|
|
cd9d16 |
diff --git a/acl.c b/acl.c
|
|
|
cd9d16 |
index 82c2704..cae059f 100644
|
|
|
cd9d16 |
--- a/acl.c
|
|
|
cd9d16 |
+++ b/acl.c
|
|
|
cd9d16 |
@@ -95,13 +95,13 @@ int qemu_acl_party_is_allowed(qemu_acl *acl,
|
|
|
cd9d16 |
|
|
|
cd9d16 |
void qemu_acl_reset(qemu_acl *acl)
|
|
|
cd9d16 |
{
|
|
|
cd9d16 |
- qemu_acl_entry *entry;
|
|
|
cd9d16 |
+ qemu_acl_entry *entry, *next_entry;
|
|
|
cd9d16 |
|
|
|
cd9d16 |
/* Put back to deny by default, so there is no window
|
|
|
cd9d16 |
* of "open access" while the user re-initializes the
|
|
|
cd9d16 |
* access control list */
|
|
|
cd9d16 |
acl->defaultDeny = 1;
|
|
|
cd9d16 |
- QTAILQ_FOREACH(entry, &acl->entries, next) {
|
|
|
cd9d16 |
+ QTAILQ_FOREACH_SAFE(entry, &acl->entries, next, next_entry) {
|
|
|
cd9d16 |
QTAILQ_REMOVE(&acl->entries, entry, next);
|
|
|
cd9d16 |
free(entry->match);
|
|
|
cd9d16 |
free(entry);
|
|
|
cd9d16 |
--
|
|
|
cd9d16 |
1.7.11.2
|
|
|
cd9d16 |
|