10be627d2b
The TLS handshake make take some time to complete, during which time an I/O watch might be registered with the main loop. If the owner of the I/O channel invokes qio_channel_close() while the handshake is waiting to continue the I/O watch must be removed. Failing to remove it will later trigger the completion callback which the owner is not expecting to receive. In the case of the VNC server, this results in a SEGV as vnc_disconnect_start() tries to shutdown a client connection that is already gone / NULL. CVE-2023-3354 Reported-by: jiangyegen <jiangyegen@huawei.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> |
||
|---|---|---|
| .. | ||
| channel-buffer.c | ||
| channel-command.c | ||
| channel-file.c | ||
| channel-null.c | ||
| channel-socket.c | ||
| channel-tls.c | ||
| channel-util.c | ||
| channel-watch.c | ||
| channel-websock.c | ||
| channel.c | ||
| dns-resolver.c | ||
| meson.build | ||
| net-listener.c | ||
| task.c | ||
| trace-events | ||
| trace.h | ||