mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

qom: code hardening - have bound checking while looping with integer value

Browse Source 
Object property insertion code iterates over an integer to get an unused
index that can be used as an unique name for an object property. This loop
increments the integer value indefinitely. Although very unlikely, this can
still cause an integer overflow.
In this change, we fix the above code by checking against INT16_MAX and making
sure that the interger index does not overflow beyond that value. If no
available index is found, the code would cause an assertion failure. This
assertion failure is necessary because the callers of the function do not check
the return value for NULL.

Signed-off-by: Ani Sinha <ani@anisinha.ca>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20200921093325.25617-1-ani@anisinha.ca>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
This commit is contained in:
Ani Sinha 2020-09-21 15:03:25 +05:30 committed by Eduardo Habkost
parent 2ecfc0657a
commit 1bf8b88f14
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
qom/object.c
View File

@ -1196,11 +1196,11 @@ object_property_try_add(Object *obj, const char *name, const char *type,
if (name_len >= 3 && !memcmp(name + name_len - 3, "[*]", 4)) { if (name_len >= 3 && !memcmp(name + name_len - 3, "[*]", 4)) {
int i; int i;
ObjectProperty *ret; ObjectProperty *ret = NULL;
char *name_no_array = g_strdup(name); char *name_no_array = g_strdup(name);
name_no_array[name_len - 3] = '\0'; name_no_array[name_len - 3] = '\0';
for (i = 0; ; ++i) { for (i = 0; i < INT16_MAX; ++i) {
char *full_name = g_strdup_printf("%s[%d]", name_no_array, i); char *full_name = g_strdup_printf("%s[%d]", name_no_array, i);
ret = object_property_try_add(obj, full_name, type, get, set, ret = object_property_try_add(obj, full_name, type, get, set,
@ -1211,6 +1211,7 @@ object_property_try_add(Object *obj, const char *name, const char *type,
} }
} }
g_free(name_no_array); g_free(name_no_array);
assert(ret);
return ret; return ret;
} }