From: Prasad J Pandit <pjp@fedoraproject.org>
9p back-end first queries the size of an extended attribute,
allocates space for it via g_malloc() and then retrieves its
value into allocated buffer. Race between querying attribute
size and retrieving its could lead to memory bytes disclosure.
Use g_malloc0() to avoid it.
Reported-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
hw/9pfs/9p.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 23ac7bb532..f8bbac251d 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -3234,7 +3234,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque)
xattr_fidp->fid_type = P9_FID_XATTR;
xattr_fidp->fs.xattr.xattrwalk_fid = true;
if (size) {
- xattr_fidp->fs.xattr.value = g_malloc(size);
+ xattr_fidp->fs.xattr.value = g_malloc0(size);
err = v9fs_co_llistxattr(pdu, &xattr_fidp->path,
xattr_fidp->fs.xattr.value,
xattr_fidp->fs.xattr.len);
@@ -3267,7 +3267,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque)
xattr_fidp->fid_type = P9_FID_XATTR;
xattr_fidp->fs.xattr.xattrwalk_fid = true;
if (size) {
- xattr_fidp->fs.xattr.value = g_malloc(size);
+ xattr_fidp->fs.xattr.value = g_malloc0(size);
err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path,
&name, xattr_fidp->fs.xattr.value,
xattr_fidp->fs.xattr.len);
--
2.13.6
On Wed, 4 Oct 2017 17:06:52 +0530 P J P <ppandit@redhat.com> wrote: > From: Prasad J Pandit <pjp@fedoraproject.org> > > 9p back-end first queries the size of an extended attribute, > allocates space for it via g_malloc() and then retrieves its > value into allocated buffer. Race between querying attribute > size and retrieving its could lead to memory bytes disclosure. > Use g_malloc0() to avoid it. > Applied to 9p-next. Thanks. > Reported-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi> > Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> > --- > hw/9pfs/9p.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c > index 23ac7bb532..f8bbac251d 100644 > --- a/hw/9pfs/9p.c > +++ b/hw/9pfs/9p.c > @@ -3234,7 +3234,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque) > xattr_fidp->fid_type = P9_FID_XATTR; > xattr_fidp->fs.xattr.xattrwalk_fid = true; > if (size) { > - xattr_fidp->fs.xattr.value = g_malloc(size); > + xattr_fidp->fs.xattr.value = g_malloc0(size); > err = v9fs_co_llistxattr(pdu, &xattr_fidp->path, > xattr_fidp->fs.xattr.value, > xattr_fidp->fs.xattr.len); > @@ -3267,7 +3267,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque) > xattr_fidp->fid_type = P9_FID_XATTR; > xattr_fidp->fs.xattr.xattrwalk_fid = true; > if (size) { > - xattr_fidp->fs.xattr.value = g_malloc(size); > + xattr_fidp->fs.xattr.value = g_malloc0(size); > err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path, > &name, xattr_fidp->fs.xattr.value, > xattr_fidp->fs.xattr.len);
© 2016 - 2024 Red Hat, Inc.