From nobody Tue Apr 30 17:06:39 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 149564275928853.652783163875256; Wed, 24 May 2017 09:19:19 -0700 (PDT) Received: from localhost ([::1]:55874 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dDZ0G-0002KZ-Q9 for importer@patchew.org; Wed, 24 May 2017 12:19:16 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57252) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dDYzQ-0001zA-LY for qemu-devel@nongnu.org; Wed, 24 May 2017 12:18:25 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dDYzN-0005gz-Ct for qemu-devel@nongnu.org; Wed, 24 May 2017 12:18:24 -0400 Received: from mx1.redhat.com ([209.132.183.28]:35190) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dDYzN-0005gY-5u for qemu-devel@nongnu.org; Wed, 24 May 2017 12:18:21 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 290273B71F; Wed, 24 May 2017 16:18:20 +0000 (UTC) Received: from dhcp-17-113.lcy.redhat.com (unknown [10.42.17.113]) by smtp.corp.redhat.com (Postfix) with ESMTP id 149F417A93; Wed, 24 May 2017 16:18:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 290273B71F Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=berrange@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 290273B71F From: "Daniel P. Berrange" To: qemu-devel@nongnu.org Date: Wed, 24 May 2017 17:18:12 +0100 Message-Id: <20170524161812.5886-1-berrange@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Wed, 24 May 2017 16:18:20 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v2] sockets: improve error reporting if UNIX socket path is too long X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Gerd Hoffmann , Simon Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The 'struct sockaddr_un' only allows 108 bytes for the socket path. If the user supplies a path, QEMU uses snprintf() to silently truncate it when too long. This is undesirable because the user will then be unable to connect to the path they asked for. If the user doesn't supply a path, QEMU builds one based on TMPDIR, but if that leads to an overlong path, it mistakenly uses error_setg_errno() with a stale errno value, because snprintf() does not set errno on truncation. Signed-off-by: Daniel P. Berrange Reviewed-by: Eric Blake --- util/qemu-sockets.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c index d8183f7..d565499 100644 --- a/util/qemu-sockets.c +++ b/util/qemu-sockets.c @@ -845,6 +845,7 @@ static int unix_listen_saddr(UnixSocketAddress *saddr, { struct sockaddr_un un; int sock, fd; + size_t pathlen; =20 sock =3D qemu_socket(PF_UNIX, SOCK_STREAM, 0); if (sock < 0) { @@ -854,15 +855,25 @@ static int unix_listen_saddr(UnixSocketAddress *saddr, =20 memset(&un, 0, sizeof(un)); un.sun_family =3D AF_UNIX; - if (saddr->path && strlen(saddr->path)) { - snprintf(un.sun_path, sizeof(un.sun_path), "%s", saddr->path); + pathlen =3D saddr->path ? strlen(saddr->path) : 0; + if (pathlen !=3D 0) { + if (pathlen > sizeof(un.sun_path)) { + error_setg(errp, "UNIX socket path '%s' is too long", saddr->p= ath); + error_append_hint(errp, "Path must be less than %zu bytes\n", + sizeof(un.sun_path)); + goto err; + } + strncpy(un.sun_path, saddr->path, sizeof(un.sun_path)); } else { + const char *template =3D "qemu-socket-XXXXXX"; const char *tmpdir =3D getenv("TMPDIR"); tmpdir =3D tmpdir ? tmpdir : "/tmp"; - if (snprintf(un.sun_path, sizeof(un.sun_path), "%s/qemu-socket-XXX= XXX", - tmpdir) >=3D sizeof(un.sun_path)) { - error_setg_errno(errp, errno, - "TMPDIR environment variable (%s) too large",= tmpdir); + if (snprintf(un.sun_path, sizeof(un.sun_path), "%s/%s", + tmpdir, template) >=3D sizeof(un.sun_path)) { + error_setg(errp, + "TMPDIR environment variable (%s) too large", tmpdi= r); + error_append_hint(errp, "Path must be less than %zu bytes\n", + sizeof(un.sun_path) - strlen(template) - 1); goto err; } =20 --=20 2.9.3