[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH] nbd/server: Use smarter assert
From: |
Eric Blake |
Subject: |
[PATCH] nbd/server: Use smarter assert |
Date: |
Mon, 17 Oct 2022 12:37:27 -0500 |
Assigning strlen() to a uint32_t and then asserting that it isn't too
large doesn't catch the case of an input string 4G in length.
Thankfully, the incoming string can never be that large: if the export
name is reflecting what the client asked about, we already guarantee
that we drop the NBD connection if the client tries to send more than
32M in a single NBD_OPT_* request; and if the export name is coming
from qemu, nbd_receive_negotiate() asserted that strlen(info->name) <=
NBD_MAX_STRING_SIZE. Still, it doesn't hurt to be more explicit in
how we write our assertion that we are aware that no wraparound is
possible.
Fixes: 93676c88 ("nbd: Don't send oversize strings", v4.2.0)
Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
nbd/client.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/nbd/client.c b/nbd/client.c
index 60c9f4941a..b601ee97e5 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -658,7 +658,7 @@ static int nbd_send_meta_query(QIOChannel *ioc, uint32_t
opt,
char *p;
data_len = sizeof(export_len) + export_len + sizeof(queries);
- assert(export_len <= NBD_MAX_STRING_SIZE);
+ assert(strlen(export) <= NBD_MAX_STRING_SIZE);
if (query) {
query_len = strlen(query);
data_len += sizeof(query_len) + query_len;
--
2.37.3
- [PATCH] nbd/server: Use smarter assert,
Eric Blake <=