* [Qemu-devel] [PATCH] vnc: fix use-after-free
@ 2018-04-20 8:48 Gerd Hoffmann
2018-04-20 9:04 ` Marc-André Lureau
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Gerd Hoffmann @ 2018-04-20 8:48 UTC (permalink / raw)
To: qemu-devel; +Cc: f4bug, berrange, Gerd Hoffmann
When vnc_client_read() return value is -1
vs is not valid any more.
Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
Reported-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
ui/vnc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/ui/vnc.c b/ui/vnc.c
index e164eb798c..5526e54f48 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
VncState *vs = opaque;
if (condition & G_IO_IN) {
if (vnc_client_read(vs) < 0) {
- goto end;
+ /* vs is free()ed here */
+ return TRUE;
}
}
if (condition & G_IO_OUT) {
vnc_client_write(vs);
}
-end:
+
if (vs->disconnecting) {
if (vs->ioc_tag != 0) {
g_source_remove(vs->ioc_tag);
--
2.9.3
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH] vnc: fix use-after-free
2018-04-20 8:48 [Qemu-devel] [PATCH] vnc: fix use-after-free Gerd Hoffmann
@ 2018-04-20 9:04 ` Marc-André Lureau
2018-04-20 9:46 ` Daniel P. Berrangé
2018-04-20 12:01 ` Philippe Mathieu-Daudé
2 siblings, 0 replies; 4+ messages in thread
From: Marc-André Lureau @ 2018-04-20 9:04 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: QEMU, Philippe Mathieu-Daudé
Hi
On Fri, Apr 20, 2018 at 10:48 AM, Gerd Hoffmann <kraxel@redhat.com> wrote:
> When vnc_client_read() return value is -1
> vs is not valid any more.
>
> Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
> Reported-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
> ui/vnc.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/ui/vnc.c b/ui/vnc.c
> index e164eb798c..5526e54f48 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
> VncState *vs = opaque;
> if (condition & G_IO_IN) {
> if (vnc_client_read(vs) < 0) {
> - goto end;
> + /* vs is free()ed here */
> + return TRUE;
> }
> }
> if (condition & G_IO_OUT) {
> vnc_client_write(vs);
> }
> -end:
> +
> if (vs->disconnecting) {
> if (vs->ioc_tag != 0) {
> g_source_remove(vs->ioc_tag);
> --
> 2.9.3
>
>
--
Marc-André Lureau
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH] vnc: fix use-after-free
2018-04-20 8:48 [Qemu-devel] [PATCH] vnc: fix use-after-free Gerd Hoffmann
2018-04-20 9:04 ` Marc-André Lureau
@ 2018-04-20 9:46 ` Daniel P. Berrangé
2018-04-20 12:01 ` Philippe Mathieu-Daudé
2 siblings, 0 replies; 4+ messages in thread
From: Daniel P. Berrangé @ 2018-04-20 9:46 UTC (permalink / raw)
To: Gerd Hoffmann, Peter Maydell; +Cc: qemu-devel, f4bug
On Fri, Apr 20, 2018 at 10:48:19AM +0200, Gerd Hoffmann wrote:
> When vnc_client_read() return value is -1
> vs is not valid any more.
>
> Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
> Reported-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> ---
> ui/vnc.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] vnc: fix use-after-free
2018-04-20 8:48 [Qemu-devel] [PATCH] vnc: fix use-after-free Gerd Hoffmann
2018-04-20 9:04 ` Marc-André Lureau
2018-04-20 9:46 ` Daniel P. Berrangé
@ 2018-04-20 12:01 ` Philippe Mathieu-Daudé
2 siblings, 0 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2018-04-20 12:01 UTC (permalink / raw)
To: Gerd Hoffmann, qemu-devel; +Cc: berrange, qemu-stable
[-- Attachment #1: Type: text/plain, Size: 1144 bytes --]
Cc'ing qemu-stable
On 04/20/2018 05:48 AM, Gerd Hoffmann wrote:
> When vnc_client_read() return value is -1
> vs is not valid any more.
>
> Fixes: d49b87f0d1e0520443a990fc610d0f02bc63c556
> Reported-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
> ui/vnc.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/ui/vnc.c b/ui/vnc.c
> index e164eb798c..5526e54f48 100644
> --- a/ui/vnc.c
> +++ b/ui/vnc.c
> @@ -1539,13 +1539,14 @@ gboolean vnc_client_io(QIOChannel *ioc G_GNUC_UNUSED,
> VncState *vs = opaque;
> if (condition & G_IO_IN) {
> if (vnc_client_read(vs) < 0) {
> - goto end;
> + /* vs is free()ed here */
> + return TRUE;
> }
> }
> if (condition & G_IO_OUT) {
> vnc_client_write(vs);
> }
> -end:
> +
> if (vs->disconnecting) {
> if (vs->ioc_tag != 0) {
> g_source_remove(vs->ioc_tag);
>
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-04-20 12:01 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-04-20 8:48 [Qemu-devel] [PATCH] vnc: fix use-after-free Gerd Hoffmann
2018-04-20 9:04 ` Marc-André Lureau
2018-04-20 9:46 ` Daniel P. Berrangé
2018-04-20 12:01 ` Philippe Mathieu-Daudé
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).