[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 1/8] util: fix abstract socket path copy
From: |
marcandre . lureau |
Subject: |
[PULL 1/8] util: fix abstract socket path copy |
Date: |
Thu, 5 Aug 2021 16:53:24 +0400 |
From: Marc-André Lureau <marcandre.lureau@redhat.com>
Commit 776b97d360 "qemu-sockets: add abstract UNIX domain socket
support" neglected to update socket_sockaddr_to_address_unix() and
copied the whole sun_path without taking "salen" into account.
Later, commit 3b14b4ec49 "sockets: Fix socket_sockaddr_to_address_unix()
for abstract sockets" handled the abstract UNIX path, by stripping the
leading \0 character and fixing address details, but didn't use salen
either.
Not taking "salen" into account may result in incorrect "path" being
returned in monitors commands, as we read past the address which is not
necessarily \0-terminated.
Fixes: 776b97d3605ed0fc94443048fdf988c7725e38a9
Fixes: 3b14b4ec49a801067da19d6b8469eb1c1911c020
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: xiaoqiang zhao <zxq_yx_007@163.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
util/qemu-sockets.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 080a240b74..f2f3676d1f 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -1345,13 +1345,16 @@ socket_sockaddr_to_address_unix(struct sockaddr_storage
*sa,
SocketAddress *addr;
struct sockaddr_un *su = (struct sockaddr_un *)sa;
+ assert(salen >= sizeof(su->sun_family) + 1 &&
+ salen <= sizeof(struct sockaddr_un));
+
addr = g_new0(SocketAddress, 1);
addr->type = SOCKET_ADDRESS_TYPE_UNIX;
#ifdef CONFIG_LINUX
if (!su->sun_path[0]) {
/* Linux abstract socket */
addr->u.q_unix.path = g_strndup(su->sun_path + 1,
- sizeof(su->sun_path) - 1);
+ salen - sizeof(su->sun_family) - 1);
addr->u.q_unix.has_abstract = true;
addr->u.q_unix.abstract = true;
addr->u.q_unix.has_tight = true;
--
2.32.0.264.g75ae10bc75
- [PULL 0/8] chardev fixes for 6.1, marcandre . lureau, 2021/08/05
- [PULL 1/8] util: fix abstract socket path copy,
marcandre . lureau <=
- [PULL 2/8] chardev/socket: print a more correct command-line address, marcandre . lureau, 2021/08/05
- [PULL 3/8] chardev: mark explicitly first argument as poisoned, marcandre . lureau, 2021/08/05
- [PULL 4/8] chardev: fix fd_chr_add_watch() when in != out, marcandre . lureau, 2021/08/05
- [PULL 5/8] chardev: fix qemu_chr_open_fd() being called with fd=-1, marcandre . lureau, 2021/08/05
- [PULL 6/8] chardev: fix qemu_chr_open_fd() with fd_in==fd_out, marcandre . lureau, 2021/08/05
- [PULL 7/8] chardev: give some context on chardev-add error, marcandre . lureau, 2021/08/05
- [PULL 8/8] chardev: report a simpler error about duplicated id, marcandre . lureau, 2021/08/05
- Re: [PULL 0/8] chardev fixes for 6.1, Peter Maydell, 2021/08/05