diff options
| author | Daniel P. Berrangé <berrange@redhat.com> | 2020-03-05 15:42:53 +0000 |
|---|---|---|
| committer | Daniel P. Berrangé <berrange@redhat.com> | 2020-03-06 17:02:10 +0000 |
| commit | 415e022118fc0f8acb31ca55bc57e64c5a9acf64 (patch) | |
| tree | c6392152060f9d60df833af1bc242c9051450f90 /src/libvirt.c | |
| parent | c04e25b66c2967516b41e260dedabe6f2a86d66f (diff) | |
| download | libvirt-415e022118fc0f8acb31ca55bc57e64c5a9acf64.tar.gz | |
src: fix mixup of stack and heap allocated data in auth callback
In the following recent change:
commit db72866310d1e520efa8ed2d4589bdb5e76a1c95
Author: Daniel P. Berrangé <berrange@redhat.com>
Date: Tue Jan 14 10:40:52 2020 +0000
util: add API for reading password from the console
the fact that "bufptr" pointer may point to either heap or stack
allocated data was overlooked. As a result, when the strdup was
removed, we ended up returning a pointer to the local stack to
the caller. When the caller referenced this stack pointer they
got out garbage which fairly quickly resulted in a crash.
We need to copy the stack buffer into heap memory in the username
case.
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Diffstat (limited to 'src/libvirt.c')
| -rw-r--r-- | src/libvirt.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/libvirt.c b/src/libvirt.c index a30eaa7590..76bf1fa677 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -111,7 +111,7 @@ virConnectAuthCallbackDefault(virConnectCredentialPtr cred, for (i = 0; i < ncred; i++) { char buf[1024]; - char *bufptr = buf; + char *bufptr = NULL; size_t len; switch (cred[i].type) { @@ -138,14 +138,15 @@ virConnectAuthCallbackDefault(virConnectCredentialPtr cred, if (!fgets(buf, sizeof(buf), stdin)) { if (feof(stdin)) { /* Treat EOF as "" */ - buf[0] = '\0'; break; } return -1; } + len = strlen(buf); if (len != 0 && buf[len-1] == '\n') buf[len-1] = '\0'; + bufptr = g_strdup(buf); break; case VIR_CRED_PASSPHRASE: |