francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
61 lines
2.6 KiB
Diff
61 lines
2.6 KiB
Diff
From 36cd5554b50656f3492197f0fc02534dcc6b980f Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Jonas=20=C3=85dahl?= <jadahl@gmail.com>
|
|
Date: Tue, 13 May 2025 10:34:08 +0200
|
|
Subject: [PATCH] transport: Initialize function pointers after resource
|
|
allocation
|
|
|
|
The transport instance is freed when an error occurs.
|
|
If the TransportDisconnect function pointer is initialized it
|
|
causes SIGSEGV during free.
|
|
|
|
CVE: CVE-2025-4478
|
|
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/a4bb702aa62e4fad91ca99142de075265555ec18]
|
|
(cherry picked from commit a4bb702aa62e4fad91ca99142de075265555ec18)
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
---
|
|
libfreerdp/core/transport.c | 24 ++++++++++++------------
|
|
1 file changed, 12 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/libfreerdp/core/transport.c b/libfreerdp/core/transport.c
|
|
index a2a899b79..552a28a60 100644
|
|
--- a/libfreerdp/core/transport.c
|
|
+++ b/libfreerdp/core/transport.c
|
|
@@ -1560,18 +1560,6 @@ rdpTransport* transport_new(rdpContext* context)
|
|
if (!transport->log)
|
|
goto fail;
|
|
|
|
- // transport->io.DataHandler = transport_data_handler;
|
|
- transport->io.TCPConnect = freerdp_tcp_default_connect;
|
|
- transport->io.TLSConnect = transport_default_connect_tls;
|
|
- transport->io.TLSAccept = transport_default_accept_tls;
|
|
- transport->io.TransportAttach = transport_default_attach;
|
|
- transport->io.TransportDisconnect = transport_default_disconnect;
|
|
- transport->io.ReadPdu = transport_default_read_pdu;
|
|
- transport->io.WritePdu = transport_default_write;
|
|
- transport->io.ReadBytes = transport_read_layer;
|
|
- transport->io.GetPublicKey = transport_default_get_public_key;
|
|
- transport->io.SetBlockingMode = transport_default_set_blocking_mode;
|
|
-
|
|
transport->context = context;
|
|
transport->ReceivePool = StreamPool_New(TRUE, BUFFER_SIZE);
|
|
|
|
@@ -1610,6 +1598,18 @@ rdpTransport* transport_new(rdpContext* context)
|
|
if (!InitializeCriticalSectionAndSpinCount(&(transport->WriteLock), 4000))
|
|
goto fail;
|
|
|
|
+ // transport->io.DataHandler = transport_data_handler;
|
|
+ transport->io.TCPConnect = freerdp_tcp_default_connect;
|
|
+ transport->io.TLSConnect = transport_default_connect_tls;
|
|
+ transport->io.TLSAccept = transport_default_accept_tls;
|
|
+ transport->io.TransportAttach = transport_default_attach;
|
|
+ transport->io.TransportDisconnect = transport_default_disconnect;
|
|
+ transport->io.ReadPdu = transport_default_read_pdu;
|
|
+ transport->io.WritePdu = transport_default_write;
|
|
+ transport->io.ReadBytes = transport_read_layer;
|
|
+ transport->io.GetPublicKey = transport_default_get_public_key;
|
|
+ transport->io.SetBlockingMode = transport_default_set_blocking_mode;
|
|
+
|
|
return transport;
|
|
fail:
|
|
WINPR_PRAGMA_DIAG_PUSH
|