conf: check size of secret file for secret object

[PATCH v2] conf: check size of secret file for secret object

Posted by Adam Julis 1 year ago

Since the empty file with a .base64 value wasn't recognized during the loading
process (starting of libvirtd), attempting to get a value for the UUID resulted
in an undefined error. This patch resolves the issue by checking the size of
the file and ensuring that the stored value is as expected (NULL).

Signed-off-by: Adam Julis <ajulis@redhat.com>
---
 src/conf/virsecretobj.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/conf/virsecretobj.c b/src/conf/virsecretobj.c
index 455798d414..66270e2751 100644
--- a/src/conf/virsecretobj.c
+++ b/src/conf/virsecretobj.c
@@ -836,6 +836,11 @@ virSecretLoadValue(virSecretObj *obj)
         goto cleanup;
     }
 
+    if (st.st_size < 1) {
+        ret = 0;
+        goto cleanup;
+    }
+
     contents = g_new0(char, st.st_size + 1);
 
     if (saferead(fd, contents, st.st_size) != st.st_size) {
-- 
2.47.1

Re: [PATCH v2] conf: check size of secret file for secret object

Posted by Daniel P. Berrangé 1 year ago

On Wed, Jan 15, 2025 at 02:27:20PM +0100, Adam Julis wrote:
> Since the empty file with a .base64 value wasn't recognized during the loading
> process (starting of libvirtd), attempting to get a value for the UUID resulted
> in an undefined error. This patch resolves the issue by checking the size of
> the file and ensuring that the stored value is as expected (NULL).
> 
> Signed-off-by: Adam Julis <ajulis@redhat.com>
> ---
>  src/conf/virsecretobj.c | 5 +++++
>  1 file changed, 5 insertions(+)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

> 
> diff --git a/src/conf/virsecretobj.c b/src/conf/virsecretobj.c
> index 455798d414..66270e2751 100644
> --- a/src/conf/virsecretobj.c
> +++ b/src/conf/virsecretobj.c
> @@ -836,6 +836,11 @@ virSecretLoadValue(virSecretObj *obj)
>          goto cleanup;
>      }
>  
> +    if (st.st_size < 1) {
> +        ret = 0;
> +        goto cleanup;
> +    }
> +
>      contents = g_new0(char, st.st_size + 1);
>  
>      if (saferead(fd, contents, st.st_size) != st.st_size) {
> -- 
> 2.47.1
> 

With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|