qemu: Fix crash in qemuBuildDeviceCommandlineHandleOverrides

[PATCH] qemu: Fix crash in qemuBuildDeviceCommandlineHandleOverrides

Posted by Peter Krempa 3 years, 8 months ago

'STREQ' is used to compare the override alias with the device alias.
While the parser ensures that the override alias is non-NULL, the device
alias may be NULL and STREQ doesn't handle that.

Fixes: 38ab5c9ead5
Resolves: https://gitlab.com/libvirt/libvirt/-/issues/321
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
---
 src/qemu/qemu_command.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 52e4ef03cd..b1be77743c 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -240,6 +240,10 @@ qemuBuildDeviceCommandlineHandleOverrides(virJSONValue *props,
     const char *alias = virJSONValueObjectGetString(props, "id");
     size_t i;

+    /* If the device doesn't have an alias we can't override it's props */
+    if (!alias)
+        return;
+
     for (i = 0; i < nsdef->ndeviceOverride; i++) {
         qemuDomainXmlNsDeviceOverride *dev = nsdef->deviceOverride + i;
         size_t j;
-- 
2.36.1

Re: [PATCH] qemu: Fix crash in qemuBuildDeviceCommandlineHandleOverrides

Posted by Ján Tomko 3 years, 8 months ago

On a Monday in 2022, Peter Krempa wrote:
>'STREQ' is used to compare the override alias with the device alias.
>While the parser ensures that the override alias is non-NULL, the device
>alias may be NULL and STREQ doesn't handle that.
>
>Fixes: 38ab5c9ead5
>Resolves: https://gitlab.com/libvirt/libvirt/-/issues/321
>Signed-off-by: Peter Krempa <pkrempa@redhat.com>
>---
> src/qemu/qemu_command.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
>index 52e4ef03cd..b1be77743c 100644
>--- a/src/qemu/qemu_command.c
>+++ b/src/qemu/qemu_command.c
>@@ -240,6 +240,10 @@ qemuBuildDeviceCommandlineHandleOverrides(virJSONValue *props,
>     const char *alias = virJSONValueObjectGetString(props, "id");
>     size_t i;
>
>+    /* If the device doesn't have an alias we can't override it's props */

*its

>+    if (!alias)
>+        return;
>+
>     for (i = 0; i < nsdef->ndeviceOverride; i++) {
>         qemuDomainXmlNsDeviceOverride *dev = nsdef->deviceOverride + i;
>         size_t j;

Reviewed-by: Ján Tomko <jtomko@redhat.com>

Jano

Re: [PATCH] qemu: Fix crash in qemuBuildDeviceCommandlineHandleOverrides

Posted by Pavel Hrdina 3 years, 8 months ago

On Mon, Jun 06, 2022 at 10:26:38AM +0200, Peter Krempa wrote:
> 'STREQ' is used to compare the override alias with the device alias.
> While the parser ensures that the override alias is non-NULL, the device
> alias may be NULL and STREQ doesn't handle that.
> 
> Fixes: 38ab5c9ead5
> Resolves: https://gitlab.com/libvirt/libvirt/-/issues/321
> Signed-off-by: Peter Krempa <pkrempa@redhat.com>
> ---
>  src/qemu/qemu_command.c | 4 ++++
>  1 file changed, 4 insertions(+)

Reviewed-by: Pavel Hrdina <phrdina@redhat.com>