[PATCH v2 01/18] crypto: Fix certificate file error handling crash bug
qcrypto_tls_creds_load_cert() passes uninitialized GError *gerr by reference to g_file_get_contents(). When g_file_get_contents() fails, it'll try to set a GError. Unless @gerr is null by dumb luck, this logs a ERROR_OVERWRITTEN_WARNING warning message and leaves @gerr unchanged. qcrypto_tls_creds_load_cert() then dereferences the uninitialized @gerr. Fix by initializing @gerr properly. Fixes: 9a2fd4347c40321f5cbb4ab4220e759fcbf87d03 Cc: "Daniel P. Berrangé" Signed-off-by: Markus Armbruster --- crypto/tlscredsx509.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c index 01fc304e5d..53a4368f49 100644 --- a/crypto/tlscredsx509.c +++ b/crypto/tlscredsx509.c @@ -380,7 +380,7 @@ qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds, gnutls_x509_crt_t cert = NULL; g_autofree char *buf = NULL; gsize buflen; -GError *gerr; +GError *gerr = NULL; int ret = -1; int err; -- 2.21.0
Re: [PATCH v2 01/18] crypto: Fix certificate file error handling crash bug
On Wed, Dec 04, 2019 at 10:36:08AM +0100, Markus Armbruster wrote: > qcrypto_tls_creds_load_cert() passes uninitialized GError *gerr by > reference to g_file_get_contents(). When g_file_get_contents() fails, > it'll try to set a GError. Unless @gerr is null by dumb luck, this > logs a ERROR_OVERWRITTEN_WARNING warning message and leaves @gerr > unchanged. qcrypto_tls_creds_load_cert() then dereferences the > uninitialized @gerr. > > Fix by initializing @gerr properly. > > Fixes: 9a2fd4347c40321f5cbb4ab4220e759fcbf87d03 > Cc: "Daniel P. Berrangé" > Signed-off-by: Markus Armbruster > --- > crypto/tlscredsx509.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Acked-by: Daniel P. Berrangé Regards, Daniel -- |: https://berrange.com -o-https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o-https://fstop138.berrange.com :| |: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|
