提交 2a32bbbf 编写于 作者: D Daniel P. Berrange 提交者: Eric Blake

Fix typo in identity code which is pre-requisite for CVE-2013-4311

The fix for CVE-2013-4311 had a pre-requisite enhancement
to the identity code

  commit db7a5688
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Thu Aug 22 16:00:01 2013 +0100

    Also store user & group ID values in virIdentity

This had a typo which caused the group ID to overwrite the
user ID string. This meant any checks using this would have
the wrong ID value. This only affected the ACL code, not the
initial polkit auth. It also leaked memory.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
(cherry picked from commit e4697b92)
上级 a61ad1bc
......@@ -678,7 +678,7 @@ virNetServerClientCreateIdentity(virNetServerClientPtr client)
goto cleanup;
if (!(groupname = virGetGroupName(gid)))
goto cleanup;
if (virAsprintf(&userid, "%d", (int)gid) < 0)
if (virAsprintf(&groupid, "%d", (int)gid) < 0)
goto cleanup;
if (virAsprintf(&processid, "%llu",
(unsigned long long)pid) < 0)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册