|
 |
d146c8 |
From 47fdacf72c35cb89071084171e020b4846b3fbd6 Mon Sep 17 00:00:00 2001
|
|
|
d146c8 |
From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
|
|
|
d146c8 |
Date: Fri, 11 Jan 2019 16:34:31 +0100
|
|
|
d146c8 |
Subject: [PATCH] vnc_connection_start_tls: set tls_session to NULL after
|
|
|
d146c8 |
deinit
|
|
|
d146c8 |
MIME-Version: 1.0
|
|
|
d146c8 |
Content-Type: text/plain; charset=UTF-8
|
|
|
d146c8 |
Content-Transfer-Encoding: 8bit
|
|
|
d146c8 |
|
|
|
d146c8 |
Avoid a double free in case of a failure, e.g. when vnc_connection_tls_initialize_cert_cred
|
|
|
d146c8 |
fails to read the certificate:
|
|
|
d146c8 |
|
|
|
d146c8 |
==1154== Invalid read of size 4
|
|
|
d146c8 |
==1154== at 0x60870FB: gnutls_bye (record.c:288)
|
|
|
d146c8 |
==1154== by 0x4A46B73: vnc_connection_close (vncconnection.c:5120)
|
|
|
d146c8 |
==1154== by 0x4A4E6CA: vnc_connection_coroutine (vncconnection.c:5650)
|
|
|
d146c8 |
==1154== by 0x4A51BCE: coroutine_trampoline (coroutine_ucontext.c:55)
|
|
|
d146c8 |
==1154== by 0x5BD81FF: ??? (in /usr/lib64/libc-2.28.so)
|
|
|
d146c8 |
==1154== by 0x175DB277: ???
|
|
|
d146c8 |
==1154== Address 0x1847fcf0 is 384 bytes inside a block of size 6,496 free'd
|
|
|
d146c8 |
==1154== at 0x4839A0C: free (vg_replace_malloc.c:540)
|
|
|
d146c8 |
==1154== by 0x4A4B019: vnc_connection_start_tls (vncconnection.c:4466)
|
|
|
d146c8 |
==1154== by 0x4A4CBE8: vnc_connection_perform_auth_vencrypt (vncconnection.c:4708)
|
|
|
d146c8 |
==1154== by 0x4A4CBE8: vnc_connection_perform_auth (vncconnection.c:4818)
|
|
|
d146c8 |
==1154== by 0x4A4CBE8: vnc_connection_initialize (vncconnection.c:5415)
|
|
|
d146c8 |
==1154== by 0x4A4E50F: vnc_connection_coroutine (vncconnection.c:5639)
|
|
|
d146c8 |
==1154== by 0x4A51BCE: coroutine_trampoline (coroutine_ucontext.c:55)
|
|
|
d146c8 |
==1154== by 0x5BD81FF: ??? (in /usr/lib64/libc-2.28.so)
|
|
|
d146c8 |
==1154== by 0x175DB277: ???
|
|
|
d146c8 |
==1154== Block was alloc'd at
|
|
|
d146c8 |
==1154== at 0x483AB1A: calloc (vg_replace_malloc.c:762)
|
|
|
d146c8 |
==1154== by 0x60B6FDE: gnutls_init (state.c:465)
|
|
|
d146c8 |
==1154== by 0x4A4AB28: vnc_connection_start_tls (vncconnection.c:4434)
|
|
|
d146c8 |
==1154== by 0x4A4CBE8: vnc_connection_perform_auth_vencrypt (vncconnection.c:4708)
|
|
|
d146c8 |
==1154== by 0x4A4CBE8: vnc_connection_perform_auth (vncconnection.c:4818)
|
|
|
d146c8 |
==1154== by 0x4A4CBE8: vnc_connection_initialize (vncconnection.c:5415)
|
|
|
d146c8 |
==1154== by 0x4A4E50F: vnc_connection_coroutine (vncconnection.c:5639)
|
|
|
d146c8 |
==1154== by 0x4A51BCE: coroutine_trampoline (coroutine_ucontext.c:55)
|
|
|
d146c8 |
==1154== by 0x5BD81FF: ??? (in /usr/lib64/libc-2.28.so)
|
|
|
d146c8 |
==1154== by 0x175DB277: ???
|
|
|
d146c8 |
|
|
|
d146c8 |
Signed-off-by: Ján Tomko <jtomko@redhat.com>
|
|
|
d146c8 |
(cherry picked from commit 7879ae9c747b4e95bb3850c4e67ca57d3ded82e3)
|
|
|
d146c8 |
Resolves: rhbz#1665837
|
|
|
d146c8 |
---
|
|
|
d146c8 |
src/vncconnection.c | 1 +
|
|
|
d146c8 |
1 file changed, 1 insertion(+)
|
|
|
d146c8 |
|
|
|
d146c8 |
diff --git a/src/vncconnection.c b/src/vncconnection.c
|
|
|
d146c8 |
index 7b15211..5321731 100644
|
|
|
d146c8 |
--- a/src/vncconnection.c
|
|
|
d146c8 |
+++ b/src/vncconnection.c
|
|
|
d146c8 |
@@ -4512,6 +4512,7 @@ static gboolean vnc_connection_start_tls(VncConnection *conn, int anonTLS)
|
|
|
d146c8 |
|
|
|
d146c8 |
deinit:
|
|
|
d146c8 |
gnutls_deinit(priv->tls_session);
|
|
|
d146c8 |
+ priv->tls_session = NULL;
|
|
|
d146c8 |
return FALSE;
|
|
|
d146c8 |
}
|
|
|
d146c8 |
|