diff options
author | Basil Salman <basil@daynix.com> | 2020-03-11 19:04:17 +0200 |
---|---|---|
committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2020-06-03 20:13:51 -0500 |
commit | 4996bd71611c756681bf3dc410957946b5f7083f (patch) | |
tree | 155697c26c47fc32dc7d4e9c28821dafd30d1516 /qga/commands-win32.c | |
parent | 3c3e1653c5c09391c154c5f36bf8646ce2bde9f9 (diff) | |
download | qemu-4996bd71611c756681bf3dc410957946b5f7083f.zip qemu-4996bd71611c756681bf3dc410957946b5f7083f.tar.gz qemu-4996bd71611c756681bf3dc410957946b5f7083f.tar.bz2 |
qga-win: prevent crash when executing guest-file-read with large count
guest-file-read command is currently implemented to read from a
file handle count number of bytes. when executed with a very large count number
qemu-ga crashes.
after some digging turns out that qemu-ga crashes after trying to allocate
a buffer large enough to save the data read in it, the buffer was allocated using
g_malloc0 which is not fail safe, and results a crash in case of failure.
g_malloc0 was replaced with g_try_malloc0() which returns NULL on failure,
A check was added for that case in order to prevent qemu-ga from crashing
and to send a response to the qemu-ga client accordingly.
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1594054
Signed-off-by: Basil Salman <basil@daynix.com>
Reported-by: Fakhri Zulkifli <mohdfakhrizulkifli@gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
(cherry picked from commit 807e2b6fce022707418bc8f61c069d91c613b3d2)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'qga/commands-win32.c')
-rw-r--r-- | qga/commands-win32.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/qga/commands-win32.c b/qga/commands-win32.c index 55ba5b2..01e02e4 100644 --- a/qga/commands-win32.c +++ b/qga/commands-win32.c @@ -342,7 +342,13 @@ GuestFileRead *qmp_guest_file_read(int64_t handle, bool has_count, } fh = gfh->fh; - buf = g_malloc0(count+1); + buf = g_try_malloc0(count + 1); + if (!buf) { + error_setg(errp, + "failed to allocate sufficient memory " + "to complete the requested service"); + return NULL; + } is_ok = ReadFile(fh, buf, count, &read_count, NULL); if (!is_ok) { error_setg_win32(errp, GetLastError(), "failed to read file"); |