diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2017-11-28 13:12:48 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2017-11-28 13:12:48 +0000 |
| commit | 844496f3e55a2155200fdcf7f6320acef03d4e9f (patch) | |
| tree | 1bf31a24a3f2440976d25bc5a51d7f67e979b4c8 | |
| parent | a914f04c23385953cb2f9b34dc879e03c880d4b2 (diff) | |
| parent | 51ae4f8455c9e32c54770c4ebc25bf86a8128183 (diff) | |
| download | qemu-844496f3e55a2155200fdcf7f6320acef03d4e9f.tar.gz | |
Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-11-28' into staging
nbd patches for 2017-11-28
Eric Blake - 0/2 fix two NBD server CVEs
# gpg: Signature made Tue 28 Nov 2017 12:58:29 GMT
# gpg: using RSA key 0xA7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>"
# gpg: aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>"
# gpg: aka "[jpeg image of size 6874]"
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2 F3AA A7A1 6B4A 2527 436A
* remotes/ericb/tags/pull-nbd-2017-11-28:
nbd/server: CVE-2017-15118 Stack smash on large export name
nbd/server: CVE-2017-15119 Reject options larger than 32M
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | nbd/server.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/nbd/server.c b/nbd/server.c index 7d6801b427..92c0fdd03b 100644 --- a/nbd/server.c +++ b/nbd/server.c @@ -386,6 +386,10 @@ static int nbd_negotiate_handle_info(NBDClient *client, uint32_t length, msg = "name length is incorrect"; goto invalid; } + if (namelen >= sizeof(name)) { + msg = "name too long for qemu"; + goto invalid; + } if (nbd_read(client->ioc, name, namelen, errp) < 0) { return -EIO; } @@ -673,6 +677,12 @@ static int nbd_negotiate_options(NBDClient *client, uint16_t myflags, } length = be32_to_cpu(length); + if (length > NBD_MAX_BUFFER_SIZE) { + error_setg(errp, "len (%" PRIu32" ) is larger than max len (%u)", + length, NBD_MAX_BUFFER_SIZE); + return -EINVAL; + } + trace_nbd_negotiate_options_check_option(option, nbd_opt_lookup(option)); if (client->tlscreds && |