[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 2/5] qemu-bridge-helper: restrict interface name to I
From: |
Jason Wang |
Subject: |
[Qemu-devel] [PULL 2/5] qemu-bridge-helper: restrict interface name to IFNAMSIZ |
Date: |
Mon, 29 Jul 2019 16:33:43 +0800 |
From: Prasad J Pandit <address@hidden>
The network interface name in Linux is defined to be of size
IFNAMSIZ(=16), including the terminating null('\0') byte.
The same is applied to interface names read from 'bridge.conf'
file to form ACL rules. If user supplied '--br=bridge' name
is not restricted to the same length, it could lead to ACL bypass
issue. Restrict interface name to IFNAMSIZ, including null byte.
Reported-by: Riccardo Schirone <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Daniel P. Berrangé <address@hidden>
Reviewed-by: Li Qiang <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
---
qemu-bridge-helper.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c
index 95624bc..2058e10 100644
--- a/qemu-bridge-helper.c
+++ b/qemu-bridge-helper.c
@@ -119,6 +119,13 @@ static int parse_acl_file(const char *filename, ACLList
*acl_list)
}
*argend = 0;
+ if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) {
+ fprintf(stderr, "name `%s' too long: %zu\n", arg, strlen(arg));
+ fclose(f);
+ errno = EINVAL;
+ return -1;
+ }
+
if (strcmp(cmd, "deny") == 0) {
acl_rule = g_malloc(sizeof(*acl_rule));
if (strcmp(arg, "all") == 0) {
@@ -269,6 +276,10 @@ int main(int argc, char **argv)
usage();
return EXIT_FAILURE;
}
+ if (strlen(bridge) >= IFNAMSIZ) {
+ fprintf(stderr, "name `%s' too long: %zu\n", bridge, strlen(bridge));
+ return EXIT_FAILURE;
+ }
/* parse default acl file */
QSIMPLEQ_INIT(&acl_list);
--
2.5.0
- [Qemu-devel] [PULL 0/5] Net patches, Jason Wang, 2019/07/29
- [Qemu-devel] [PULL 1/5] e1000: don't raise interrupt in pre_save(), Jason Wang, 2019/07/29
- [Qemu-devel] [PULL 3/5] qemu-bridge-helper: move repeating code in parse_acl_file, Jason Wang, 2019/07/29
- [Qemu-devel] [PULL 2/5] qemu-bridge-helper: restrict interface name to IFNAMSIZ,
Jason Wang <=
- [Qemu-devel] [PULL 4/5] net: tap: replace snprintf with g_strdup_printf calls, Jason Wang, 2019/07/29
- [Qemu-devel] [PULL 5/5] net/colo-compare.c: Fix memory leak and code style issue., Jason Wang, 2019/07/29
- Re: [Qemu-devel] [PULL 0/5] Net patches, Peter Maydell, 2019/07/29