diff options
| author | Daniel P. Berrangé <berrange@redhat.com> | 2023-06-20 09:45:34 +0100 |
|---|---|---|
| committer | Daniel P. Berrangé <berrange@redhat.com> | 2023-08-01 18:45:27 +0100 |
| commit | 10be627d2b5ec2d6b3dce045144aa739eef678b4 (patch) | |
| tree | bb06bc409c11cef600556d3c3501ee03877682ab /include/io | |
| parent | 802341823f1720511dd5cf53ae40285f7978c61b (diff) | |
io: remove io watch if TLS channel is closed during handshake
The TLS handshake make take some time to complete, during which time an
I/O watch might be registered with the main loop. If the owner of the
I/O channel invokes qio_channel_close() while the handshake is waiting
to continue the I/O watch must be removed. Failing to remove it will
later trigger the completion callback which the owner is not expecting
to receive. In the case of the VNC server, this results in a SEGV as
vnc_disconnect_start() tries to shutdown a client connection that is
already gone / NULL.
CVE-2023-3354
Reported-by: jiangyegen <jiangyegen@huawei.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Diffstat (limited to 'include/io')
| -rw-r--r-- | include/io/channel-tls.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/io/channel-tls.h b/include/io/channel-tls.h index 5672479e9e..26c67f17e2 100644 --- a/include/io/channel-tls.h +++ b/include/io/channel-tls.h @@ -48,6 +48,7 @@ struct QIOChannelTLS { QIOChannel *master; QCryptoTLSSession *session; QIOChannelShutdown shutdown; + guint hs_ioc_tag; }; /** |