[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] qemu-bridge-helper: restrict bridge name to IFNAMSI
From: |
P J P |
Subject: |
[Qemu-devel] [PATCH] qemu-bridge-helper: restrict bridge name to IFNAMSIZ |
Date: |
Fri, 28 Jun 2019 15:19:01 +0530 |
From: Prasad J Pandit <address@hidden>
The interface names in qemu-bridge-helper are defined to be
of size IFNAMSIZ(=16), including the terminating null('\0') byte.
The same is applied to interface names read from 'bridge.conf'
file to form ACLs rules. If user supplied '--br=bridge' name
is not restricted to the same length, it could lead to ACL bypass
issue. Restrict bridge name to IFNAMSIZ, including null byte.
Reported-by: Riccardo Schirone <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
qemu-bridge-helper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c
index f9940deefd..2eca8c5cc4 100644
--- a/qemu-bridge-helper.c
+++ b/qemu-bridge-helper.c
@@ -246,7 +246,7 @@ int main(int argc, char **argv)
if (strcmp(argv[index], "--use-vnet") == 0) {
use_vnet = 1;
} else if (strncmp(argv[index], "--br=", 5) == 0) {
- bridge = &argv[index][5];
+ bridge = strndup(&argv[index][5], IFNAMSIZ - 1);
} else if (strncmp(argv[index], "--fd=", 5) == 0) {
unixfd = atoi(&argv[index][5]);
} else {
--
2.21.0
- [Qemu-devel] [PATCH] qemu-bridge-helper: restrict bridge name to IFNAMSIZ,
P J P <=