diff options
| author | Luyao Huang <lhuang@redhat.com> | 2014-12-03 23:01:32 +0800 |
|---|---|---|
| committer | Michal Privoznik <mprivozn@redhat.com> | 2014-12-03 17:36:07 +0100 |
| commit | 87b9437f8951f9d24f9a85c6bbfff0e54df8c984 (patch) | |
| tree | 3b14a831c6c829912058cf5362901317cd1d7ca9 | |
| parent | cd53d947eff4aeebc8b534f874431f3fd2c0cf67 (diff) | |
| download | libvirt-CVE-2014-8135.tar.gz | |
storage: fix crash caused by no check return before set closeCVE-2014-8135
https://bugzilla.redhat.com/show_bug.cgi?id=1087104#c5
When trying to use an invalid offset to virStorageVolUpload(), libvirt
fails in virFDStreamOpenFileInternal(), although it seems libvirt does
not check the return in storageVolUpload(), and calls
virFDStreamSetInternalCloseCb() right after. But stream doesn't have a
privateData (is NULL) yet, and the daemon crashes then.
0 0x00007f09429a9c10 in pthread_mutex_lock () from /lib64/libpthread.so.0
1 0x00007f094514dbf5 in virMutexLock (m=<optimized out>) at util/virthread.c:88
2 0x00007f09451cb211 in virFDStreamSetInternalCloseCb at fdstream.c:795
3 0x00007f092ff2c9eb in storageVolUpload at storage/storage_driver.c:2098
4 0x00007f09451f46e0 in virStorageVolUpload at libvirt.c:14000
5 0x00007f0945c78fa1 in remoteDispatchStorageVolUpload at remote_dispatch.h:14339
6 remoteDispatchStorageVolUploadHelper at remote_dispatch.h:14309
7 0x00007f094524a192 in virNetServerProgramDispatchCall at rpc/virnetserverprogram.c:437
Signed-off-by: Luyao Huang <lhuang@redhat.com>
| -rw-r--r-- | src/storage/storage_driver.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c index 7f33d6f1cd..7f4de193c4 100644 --- a/src/storage/storage_driver.c +++ b/src/storage/storage_driver.c @@ -2111,8 +2111,9 @@ storageVolUpload(virStorageVolPtr obj, goto cleanup; } - ret = backend->uploadVol(obj->conn, pool, vol, stream, - offset, length, flags); + if ((ret = backend->uploadVol(obj->conn, pool, vol, stream, + offset, length, flags)) < 0) + goto cleanup; /* Add cleanup callback - call after uploadVol since the stream * is then fully set up |