提交 eee8427a 编写于 作者: I Ilias Stamatis 提交者: Erik Skultety

virDomainSendKey: validate codeset argument

This argument wasn't validated anywhere, neither in the generic
implementation nor in the individual drivers. As a result a call to this
function with a large enough codeset value prior to this change causes
libvirtd to crash.

This happens because all drivers call virKeycodeValueTranslate which
uses codeset as an index to the virKeymapValues array, causing an
out-of-bounds error.
Signed-off-by: NIlias Stamatis <stamatis.iliass@gmail.com>
Reviewed-by: NErik Skultety <eskultet@redhat.com>
上级 cd3aebe9
......@@ -6837,6 +6837,13 @@ virDomainSendKey(virDomainPtr domain,
virCheckNonNullArgGoto(keycodes, error);
virCheckPositiveArgGoto(nkeycodes, error);
if (codeset >= VIR_KEYCODE_SET_LAST) {
virReportInvalidArg(codeset,
_("Unsupported codeset '%d'"),
codeset);
goto error;
}
if (nkeycodes > VIR_DOMAIN_SEND_KEY_MAX_KEYS) {
virReportInvalidArg(nkeycodes,
_("nkeycodes must be <= %d"),
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册