[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_
From: |
Peter Xu |
Subject: |
Re: [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_entries |
Date: |
Wed, 9 Mar 2016 10:57:38 +0800 |
User-agent: |
Mutt/1.5.24 (2015-08-30) |
On Tue, Mar 08, 2016 at 11:19:44AM +0100, Kevin Wolf wrote:
> Am 08.03.2016 um 09:22 hat Markus Armbruster geschrieben:
> > Same arguments as for PATCH 2, except here an argument on the maximum
> > length of subqdict would probably be easier.
>
> Yes, these are constant string literals in all callers, including the
> one non-test case in quorum.
>
> Let's simply assert a reasonable maximum for subqdict_length. The
> minimum we need to allow with the existing callers is 9, and I expect
> we'll never get keys longer than 16 characters.
Hi, Kevin, Markus,
The patch should be trying to do as mentioned above. To make it
clearer, how about the following one:
diff --git a/qobject/qdict.c b/qobject/qdict.c
index 9833bd0..dde99e0 100644
--- a/qobject/qdict.c
+++ b/qobject/qdict.c
@@ -704,17 +704,16 @@ int qdict_array_entries(QDict *src, const char *subqdict)
for (i = 0; i < INT_MAX; i++) {
QObject *subqobj;
int subqdict_entries;
- size_t slen = 32 + subqdict_len;
- char indexstr[slen], prefix[slen];
+ char indexstr[128], prefix[128];
size_t snprintf_ret;
- snprintf_ret = snprintf(indexstr, slen, "%s%u", subqdict, i);
- assert(snprintf_ret < slen);
+ snprintf_ret = snprintf(indexstr, ARRAY_SIZE(indexstr), "%s%u",
subqdict, i);
+ assert(snprintf_ret < ARRAY_SIZE(indexstr));
subqobj = qdict_get(src, indexstr);
- snprintf_ret = snprintf(prefix, slen, "%s%u.", subqdict, i);
- assert(snprintf_ret < slen);
+ snprintf_ret = snprintf(prefix, ARRAY_SIZE(prefix), "%s%u.", subqdict,
i);
+ assert(snprintf_ret < ARRAY_SIZE(prefix));
subqdict_entries = qdict_count_prefixed_entries(src, prefix);
if (subqdict_entries < 0) {
Two assertions on the snprintf_ret should make sure we are safe,
right?
Thanks.
Peter
- [Qemu-devel] [PATCH 0/8] Fix several unbounded stack usage, Peter Xu, 2016/03/08
- [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_entries, Peter Xu, 2016/03/08
- Re: [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_entries,
Peter Xu <=
- Re: [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_entries, Eric Blake, 2016/03/08
- Re: [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_entries, Peter Xu, 2016/03/08
- Re: [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_entries, Kevin Wolf, 2016/03/09
- Re: [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_entries, Markus Armbruster, 2016/03/09
- Re: [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_entries, Kevin Wolf, 2016/03/09
- Re: [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_entries, Markus Armbruster, 2016/03/09
- Re: [Qemu-devel] [PATCH 1/8] qdict: fix unbounded stack for qdict_array_entries, Peter Xu, 2016/03/09
[Qemu-devel] [PATCH 2/8] block: fix unbounded stack for dump_qdict, Peter Xu, 2016/03/08