From nobody Sun Apr 28 03:47:12 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 14956406194191022.4436185049786; Wed, 24 May 2017 08:43:39 -0700 (PDT) Received: from localhost ([::1]:55561 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dDYRl-0006O0-Oy for importer@patchew.org; Wed, 24 May 2017 11:43:37 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43273) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dDYQP-0005Iw-RF for qemu-devel@nongnu.org; Wed, 24 May 2017 11:42:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dDYQM-0000aA-N3 for qemu-devel@nongnu.org; Wed, 24 May 2017 11:42:13 -0400 Received: from mx1.redhat.com ([209.132.183.28]:39590) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dDYQM-0000Yo-H2 for qemu-devel@nongnu.org; Wed, 24 May 2017 11:42:10 -0400 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 83F5D37F1F; Wed, 24 May 2017 15:42:08 +0000 (UTC) Received: from dhcp-17-113.lcy.redhat.com (unknown [10.42.17.113]) by smtp.corp.redhat.com (Postfix) with ESMTP id 850B67EF68; Wed, 24 May 2017 15:42:07 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 83F5D37F1F Authentication-Results: ext-mx05.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx05.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=berrange@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 83F5D37F1F From: "Daniel P. Berrange" To: qemu-devel@nongnu.org Date: Wed, 24 May 2017 16:42:05 +0100 Message-Id: <20170524154205.1914-1-berrange@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Wed, 24 May 2017 15:42:08 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH] sockets: report error if UNIX socket path is too long X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Simon Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The 'struct sockaddr_un' only allows 108 bytes for the socket path. Currently QEMU uses snprintf() and so silently truncates the socket path provided by the user. This is undesirable because the user will then be unable to connect to the path they asked for. This change makes QEMU bounds check and report an explicit error message. Signed-off-by: Daniel P. Berrange --- util/qemu-sockets.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c index d8183f7..e249dbe 100644 --- a/util/qemu-sockets.c +++ b/util/qemu-sockets.c @@ -855,6 +855,12 @@ static int unix_listen_saddr(UnixSocketAddress *saddr, memset(&un, 0, sizeof(un)); un.sun_family =3D AF_UNIX; if (saddr->path && strlen(saddr->path)) { + if (strlen(saddr->path) > sizeof(un.sun_path)) { + error_setg(errp, "UNIX socket path '%s' is too long", saddr->p= ath); + error_append_hint(errp, "Path must be less than %zu bytes\n", + sizeof(un.sun_path)); + return -1; + } snprintf(un.sun_path, sizeof(un.sun_path), "%s", saddr->path); } else { const char *tmpdir =3D getenv("TMPDIR"); --=20 2.9.3