blob: f1315a38da6dbe1355b4129df7e1e81259566547 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
From 36cd5554b50656f3492197f0fc02534dcc6b980f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonas=20=C3=85dahl?= <jadahl@gmail.com>
Date: Tue, 13 May 2025 10:34:08 +0200
Subject: [PATCH] transport: Initialize function pointers after resource
allocation
The transport instance is freed when an error occurs.
If the TransportDisconnect function pointer is initialized it
causes SIGSEGV during free.
CVE: CVE-2025-4478
Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/a4bb702aa62e4fad91ca99142de075265555ec18]
(cherry picked from commit a4bb702aa62e4fad91ca99142de075265555ec18)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libfreerdp/core/transport.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/libfreerdp/core/transport.c b/libfreerdp/core/transport.c
index a2a899b79..552a28a60 100644
--- a/libfreerdp/core/transport.c
+++ b/libfreerdp/core/transport.c
@@ -1560,18 +1560,6 @@ rdpTransport* transport_new(rdpContext* context)
if (!transport->log)
goto fail;
- // transport->io.DataHandler = transport_data_handler;
- transport->io.TCPConnect = freerdp_tcp_default_connect;
- transport->io.TLSConnect = transport_default_connect_tls;
- transport->io.TLSAccept = transport_default_accept_tls;
- transport->io.TransportAttach = transport_default_attach;
- transport->io.TransportDisconnect = transport_default_disconnect;
- transport->io.ReadPdu = transport_default_read_pdu;
- transport->io.WritePdu = transport_default_write;
- transport->io.ReadBytes = transport_read_layer;
- transport->io.GetPublicKey = transport_default_get_public_key;
- transport->io.SetBlockingMode = transport_default_set_blocking_mode;
-
transport->context = context;
transport->ReceivePool = StreamPool_New(TRUE, BUFFER_SIZE);
@@ -1610,6 +1598,18 @@ rdpTransport* transport_new(rdpContext* context)
if (!InitializeCriticalSectionAndSpinCount(&(transport->WriteLock), 4000))
goto fail;
+ // transport->io.DataHandler = transport_data_handler;
+ transport->io.TCPConnect = freerdp_tcp_default_connect;
+ transport->io.TLSConnect = transport_default_connect_tls;
+ transport->io.TLSAccept = transport_default_accept_tls;
+ transport->io.TransportAttach = transport_default_attach;
+ transport->io.TransportDisconnect = transport_default_disconnect;
+ transport->io.ReadPdu = transport_default_read_pdu;
+ transport->io.WritePdu = transport_default_write;
+ transport->io.ReadBytes = transport_read_layer;
+ transport->io.GetPublicKey = transport_default_get_public_key;
+ transport->io.SetBlockingMode = transport_default_set_blocking_mode;
+
return transport;
fail:
WINPR_PRAGMA_DIAG_PUSH
|
