aboutsummaryrefslogtreecommitdiff
path: root/qemu-bridge-helper.c
diff options
context:
space:
mode:
authorPrasad J Pandit <pjp@fedoraproject.org>2019-07-23 16:17:52 +0530
committerJason Wang <jasowang@redhat.com>2019-07-29 16:29:30 +0800
commit6f5d8671225dc77190647f18a27a0d156d4ca97a (patch)
treedd5953e52468dfc108a332a86c178574348564cd /qemu-bridge-helper.c
parentf46efa9b0895a7ff8ed0b4e874aee52a49f2a878 (diff)
downloadqemu-6f5d8671225dc77190647f18a27a0d156d4ca97a.zip
qemu-6f5d8671225dc77190647f18a27a0d156d4ca97a.tar.gz
qemu-6f5d8671225dc77190647f18a27a0d156d4ca97a.tar.bz2
qemu-bridge-helper: restrict interface name to IFNAMSIZ
The network interface name in Linux is defined to be of size IFNAMSIZ(=16), including the terminating null('\0') byte. The same is applied to interface names read from 'bridge.conf' file to form ACL rules. If user supplied '--br=bridge' name is not restricted to the same length, it could lead to ACL bypass issue. Restrict interface name to IFNAMSIZ, including null byte. Reported-by: Riccardo Schirone <rschiron@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'qemu-bridge-helper.c')
-rw-r--r--qemu-bridge-helper.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c
index 95624bc..2058e10 100644
--- a/qemu-bridge-helper.c
+++ b/qemu-bridge-helper.c
@@ -119,6 +119,13 @@ static int parse_acl_file(const char *filename, ACLList *acl_list)
}
*argend = 0;
+ if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) {
+ fprintf(stderr, "name `%s' too long: %zu\n", arg, strlen(arg));
+ fclose(f);
+ errno = EINVAL;
+ return -1;
+ }
+
if (strcmp(cmd, "deny") == 0) {
acl_rule = g_malloc(sizeof(*acl_rule));
if (strcmp(arg, "all") == 0) {
@@ -269,6 +276,10 @@ int main(int argc, char **argv)
usage();
return EXIT_FAILURE;
}
+ if (strlen(bridge) >= IFNAMSIZ) {
+ fprintf(stderr, "name `%s' too long: %zu\n", bridge, strlen(bridge));
+ return EXIT_FAILURE;
+ }
/* parse default acl file */
QSIMPLEQ_INIT(&acl_list);