diff options
author | Prasad J Pandit <pjp@fedoraproject.org> | 2019-07-23 16:17:52 +0530 |
---|---|---|
committer | Jason Wang <jasowang@redhat.com> | 2019-07-29 16:29:30 +0800 |
commit | 6f5d8671225dc77190647f18a27a0d156d4ca97a (patch) | |
tree | dd5953e52468dfc108a332a86c178574348564cd | |
parent | f46efa9b0895a7ff8ed0b4e874aee52a49f2a878 (diff) | |
download | qemu-6f5d8671225dc77190647f18a27a0d156d4ca97a.zip qemu-6f5d8671225dc77190647f18a27a0d156d4ca97a.tar.gz qemu-6f5d8671225dc77190647f18a27a0d156d4ca97a.tar.bz2 |
qemu-bridge-helper: restrict interface name to IFNAMSIZ
The network interface name in Linux is defined to be of size
IFNAMSIZ(=16), including the terminating null('\0') byte.
The same is applied to interface names read from 'bridge.conf'
file to form ACL rules. If user supplied '--br=bridge' name
is not restricted to the same length, it could lead to ACL bypass
issue. Restrict interface name to IFNAMSIZ, including null byte.
Reported-by: Riccardo Schirone <rschiron@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
-rw-r--r-- | qemu-bridge-helper.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c index 95624bc..2058e10 100644 --- a/qemu-bridge-helper.c +++ b/qemu-bridge-helper.c @@ -119,6 +119,13 @@ static int parse_acl_file(const char *filename, ACLList *acl_list) } *argend = 0; + if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) { + fprintf(stderr, "name `%s' too long: %zu\n", arg, strlen(arg)); + fclose(f); + errno = EINVAL; + return -1; + } + if (strcmp(cmd, "deny") == 0) { acl_rule = g_malloc(sizeof(*acl_rule)); if (strcmp(arg, "all") == 0) { @@ -269,6 +276,10 @@ int main(int argc, char **argv) usage(); return EXIT_FAILURE; } + if (strlen(bridge) >= IFNAMSIZ) { + fprintf(stderr, "name `%s' too long: %zu\n", bridge, strlen(bridge)); + return EXIT_FAILURE; + } /* parse default acl file */ QSIMPLEQ_INIT(&acl_list); |