Message ID | 1475247721-30670-1-git-send-email-berrange@redhat.com |
---|---|
State | New |
Headers | show |
On 09/30/2016 10:02 AM, Daniel P. Berrange wrote: > If the qio_channel_tls_new_(server|client) methods fail, > we disconnect the client. Unfortunately a missing return > means we then go on to try and run the TLS handshake on > a NULL I/O channel. This gives predictably segfaulty > results. > > The main way to trigger this is to request a bogus TLS > priority string for the TLS credentials. e.g. > > -object tls-creds-x509,id=tls0,priority=wibble,... > > Most other ways appear impossible to trigger except > perhaps if OOM conditions cause gnutls initialization > to fail. > > Signed-off-by: Daniel P. Berrange <berrange@redhat.com> > --- > qemu-char.c | 1 + > 1 file changed, 1 insertion(+) Reviewed-by: Eric Blake <eblake@redhat.com>
30.09.2016 18:02, Daniel P. Berrange wrote: > If the qio_channel_tls_new_(server|client) methods fail, > we disconnect the client. Unfortunately a missing return > means we then go on to try and run the TLS handshake on > a NULL I/O channel. This gives predictably segfaulty > results. Applied to -trivial, thanks! /mjt
diff --git a/qemu-char.c b/qemu-char.c index fb456ce..48a45ef 100644 --- a/qemu-char.c +++ b/qemu-char.c @@ -3132,6 +3132,7 @@ static void tcp_chr_tls_init(CharDriverState *chr) if (tioc == NULL) { error_free(err); tcp_chr_disconnect(chr); + return; } object_unref(OBJECT(s->ioc)); s->ioc = QIO_CHANNEL(tioc);
If the qio_channel_tls_new_(server|client) methods fail, we disconnect the client. Unfortunately a missing return means we then go on to try and run the TLS handshake on a NULL I/O channel. This gives predictably segfaulty results. The main way to trigger this is to request a bogus TLS priority string for the TLS credentials. e.g. -object tls-creds-x509,id=tls0,priority=wibble,... Most other ways appear impossible to trigger except perhaps if OOM conditions cause gnutls initialization to fail. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- qemu-char.c | 1 + 1 file changed, 1 insertion(+)