diff options
| author | Shannon Zhao <zhaoshenglong@huawei.com> | 2015-03-14 10:00:16 +0800 |
|---|---|---|
| committer | Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> | 2015-03-16 13:29:12 +0530 |
| commit | 25ee9a7fa3f4e09fde48bb184447ff5651ed5fd8 (patch) | |
| tree | 13f531dfa9dfedca628554ac6f48b9566acd3c44 | |
| parent | 821c447675728ca06c8d2e4ac8a0e7a1adf775b8 (diff) | |
| download | qemu-25ee9a7fa3f4e09fde48bb184447ff5651ed5fd8.tar.gz | |
virtfs-proxy: Fix possible overflow
It's detected by coverity. The socket name specified
should fit in the sockadd_un.sun_path. If not abort.
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
| -rw-r--r-- | fsdev/virtfs-proxy-helper.c | 1 | ||||
| -rw-r--r-- | hw/9pfs/virtio-9p-proxy.c | 4 |
2 files changed, 5 insertions, 0 deletions
diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c index bf2e5f3331..13fe032543 100644 --- a/fsdev/virtfs-proxy-helper.c +++ b/fsdev/virtfs-proxy-helper.c @@ -738,6 +738,7 @@ static int proxy_socket(const char *path, uid_t uid, gid_t gid) return -1; } + g_assert(strlen(path) < sizeof(proxy.sun_path)); sock = socket(AF_UNIX, SOCK_STREAM, 0); if (sock < 0) { do_perror("socket"); diff --git a/hw/9pfs/virtio-9p-proxy.c b/hw/9pfs/virtio-9p-proxy.c index 6bb191ee6a..71b6198bbd 100644 --- a/hw/9pfs/virtio-9p-proxy.c +++ b/hw/9pfs/virtio-9p-proxy.c @@ -1100,6 +1100,10 @@ static int connect_namedsocket(const char *path) int sockfd, size; struct sockaddr_un helper; + if (strlen(path) >= sizeof(helper.sun_path)) { + fprintf(stderr, "Socket name too large\n"); + return -1; + } sockfd = socket(AF_UNIX, SOCK_STREAM, 0); if (sockfd < 0) { fprintf(stderr, "failed to create socket: %s\n", strerror(errno)); |