ui/clipboard: fix use-after-free regression

[PATCH] ui/clipboard: fix use-after-free regression

Posted by marcandre.lureau@redhat.com 2 years, 2 months ago

From: Marc-André Lureau <marcandre.lureau@redhat.com>

The same info may be used to update the clipboard, and may be freed
before being ref'ed again.

Fixes: 70a54b01693ed ("ui: avoid compiler warnings from unused clipboard info variable")

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/clipboard.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/ui/clipboard.c b/ui/clipboard.c
index 5f15cf853d07..9079ef829b51 100644
--- a/ui/clipboard.c
+++ b/ui/clipboard.c
@@ -66,8 +66,10 @@ void qemu_clipboard_update(QemuClipboardInfo *info)
 
     notifier_list_notify(&clipboard_notifiers, &notify);
 
-    qemu_clipboard_info_unref(cbinfo[info->selection]);
-    cbinfo[info->selection] = qemu_clipboard_info_ref(info);
+    if (cbinfo[info->selection] != info) {
+        qemu_clipboard_info_unref(cbinfo[info->selection]);
+        cbinfo[info->selection] = qemu_clipboard_info_ref(info);
+    }
 }
 
 QemuClipboardInfo *qemu_clipboard_info(QemuClipboardSelection selection)
-- 
2.34.1.428.gdcc0cd074f0c

Re: [PATCH] ui/clipboard: fix use-after-free regression

Posted by Daniel P. Berrangé 2 years, 2 months ago

On Mon, Feb 14, 2022 at 03:59:17PM +0400, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> The same info may be used to update the clipboard, and may be freed
> before being ref'ed again.

Ewww, subtle.

> Fixes: 70a54b01693ed ("ui: avoid compiler warnings from unused clipboard info variable")
> 
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  ui/clipboard.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/ui/clipboard.c b/ui/clipboard.c
> index 5f15cf853d07..9079ef829b51 100644
> --- a/ui/clipboard.c
> +++ b/ui/clipboard.c
> @@ -66,8 +66,10 @@ void qemu_clipboard_update(QemuClipboardInfo *info)
>  
>      notifier_list_notify(&clipboard_notifiers, &notify);
>  
> -    qemu_clipboard_info_unref(cbinfo[info->selection]);
> -    cbinfo[info->selection] = qemu_clipboard_info_ref(info);
> +    if (cbinfo[info->selection] != info) {
> +        qemu_clipboard_info_unref(cbinfo[info->selection]);
> +        cbinfo[info->selection] = qemu_clipboard_info_ref(info);
> +    }
>  }

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|