提交 582c75ec 编写于 作者: E Eric Blake

uml: sanity check external data before using it

Otherwise, a malicious packet could cause a DoS via spurious
out-of-memory failure.

* src/uml/uml_driver.c (umlMonitorCommand): Validate that incoming
data is reliable before using it to allocate/dereference memory.
Don't report bogus errno on short read.
Reported by Jim Meyering.
上级 d0dabc2b
......@@ -734,15 +734,15 @@ static int umlMonitorCommand(const struct uml_driver *driver,
if (nbytes < 0) {
if (errno == EAGAIN || errno == EINTR)
continue;
virReportSystemError(errno,
_("cannot read reply %s"),
cmd);
virReportSystemError(errno, _("cannot read reply %s"), cmd);
goto error;
}
if (nbytes < sizeof res) {
virReportSystemError(errno,
_("incomplete reply %s"),
cmd);
virReportSystemError(0, _("incomplete reply %s"), cmd);
goto error;
}
if (sizeof res.data < res.length) {
virReportSystemError(0, _("invalid length in reply %s"), cmd);
goto error;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册