29 lines
886 B
Diff
29 lines
886 B
Diff
|
commit f38c8185f97720ecae7ef2291fbaa5d6b0209e17
|
||
|
|
Author: Ján Tomko <jtomko@redhat.com>
|
||
|
|
Date: Tue Jul 2 15:17:09 2013 +0200
|
||
|
|
|
||
|
|
Fix crash when multiple event callbacks were registered
|
||
|
|
|
||
|
|
CVE-2013-2230
|
||
|
|
|
||
|
|
Don't overwrite the callback ID returned by
|
||
|
|
virDomainEventStateRegisterID in ret by 0.
|
||
|
|
|
||
|
|
Introduced by abf75aea.
|
||
|
|
|
||
|
|
Index: libvirt-1.1.0/src/qemu/qemu_driver.c
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-1.1.0.orig/src/qemu/qemu_driver.c
|
||
|
|
+++ libvirt-1.1.0/src/qemu/qemu_driver.c
|
||
|
|
@@ -9914,9 +9914,7 @@ qemuConnectDomainEventRegisterAny(virCon
|
||
|
|
driver->domainEventState,
|
||
|
|
dom, eventID,
|
||
|
|
callback, opaque, freecb, &ret) < 0)
|
||
|
|
- goto cleanup;
|
||
|
|
-
|
||
|
|
- ret = 0;
|
||
|
|
+ ret = -1;
|
||
|
|
|
||
|
|
cleanup:
|
||
|
|
return ret;
|