From bfe11034e00fd8e328fdc9194a753063ec53ce10 Mon Sep 17 00:00:00 2001 Message-Id: From: Jiri Denemark Date: Mon, 13 Jan 2014 15:46:24 +0100 Subject: [PATCH] Really don't crash if a connection closes early CVE-2014-1447 When writing commit 173c291, I missed the fact virNetServerClientClose unlocks the client object before actually clearing client->sock and thus it is possible to hit a window when client->keepalive is NULL while client->sock is not NULL. I was thinking client->sock == NULL was a better check for a closed connection but apparently we have to go with client->keepalive == NULL to actually fix the crash. Signed-off-by: Jiri Denemark (cherry picked from commit 066c8ef6c18bc1faf8b3e10787b39796a7a06cc0) --- src/rpc/virnetserverclient.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rpc/virnetserverclient.c b/src/rpc/virnetserverclient.c index 64e91d3..56ca23b 100644 --- a/src/rpc/virnetserverclient.c +++ b/src/rpc/virnetserverclient.c @@ -1540,7 +1540,7 @@ virNetServerClientStartKeepAlive(virNetServerClientPtr client) /* The connection might have been closed before we got here and thus the * keepalive object could have been removed too. */ - if (!client->sock) { + if (!client->keepalive) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("connection not open")); goto cleanup; -- 1.8.5.3