• P
    rpc: Fix crash on error paths of message dispatching · b5a34d96
    Peter Krempa 提交于
    This patch resolves CVE-2013-0170:
    https://bugzilla.redhat.com/show_bug.cgi?id=893450
    
    When reading and dispatching of a message failed the message was freed
    but wasn't removed from the message queue.
    
    After that when the connection was about to be closed the pointer for
    the message was still present in the queue and it was passed to
    virNetMessageFree which tried to call the callback function from an
    uninitialized pointer.
    
    This patch removes the message from the queue before it's freed.
    
    * rpc/virnetserverclient.c: virNetServerClientDispatchRead:
        - avoid use after free of RPC messages
    (cherry picked from commit 46532e3e)
    
    Conflicts:
    	src/rpc/virnetserverclient.c
    b5a34d96
virnetserverclient.c 26.4 KB