* [PATCH v2] qom: code hardening - have bound checking while looping with integer value
@ 2020-09-21 9:07 Ani Sinha
2020-09-21 9:15 ` Daniel P. Berrangé
0 siblings, 1 reply; 2+ messages in thread
From: Ani Sinha @ 2020-09-21 9:07 UTC (permalink / raw)
To: qemu-devel
Cc: Ani Sinha, Paolo Bonzini, Daniel P. Berrangé, Eduardo Habkost
Object property insertion code iterates over an integer to get an unused
index that can be used as an unique name for an object property. This loop
increments the integer value indefinitely. Although very unlikely, this can
still cause an integer overflow.
In this change, we fix the above code by checking against INT_MAX and making
sure that the interger index does not overflow beyond that value. If no
available index is found, the code would cause an assertion failure. This
assertion failure is necessary because the callers of the function do not check
the return value for NULL.
Signed-off-by: Ani Sinha <ani@anisinha.ca>
---
qom/object.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/qom/object.c b/qom/object.c
index 387efb25eb..9962874598 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -1166,11 +1166,11 @@ object_property_try_add(Object *obj, const char *name, const char *type,
if (name_len >= 3 && !memcmp(name + name_len - 3, "[*]", 4)) {
int i;
- ObjectProperty *ret;
+ ObjectProperty *ret = NULL;
char *name_no_array = g_strdup(name);
name_no_array[name_len - 3] = '\0';
- for (i = 0; ; ++i) {
+ for (i = 0; i < INT16_MAX; ++i) {
char *full_name = g_strdup_printf("%s[%d]", name_no_array, i);
ret = object_property_try_add(obj, full_name, type, get, set,
@@ -1181,6 +1181,7 @@ object_property_try_add(Object *obj, const char *name, const char *type,
}
}
g_free(name_no_array);
+ assert(ret);
return ret;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] qom: code hardening - have bound checking while looping with integer value
2020-09-21 9:07 [PATCH v2] qom: code hardening - have bound checking while looping with integer value Ani Sinha
@ 2020-09-21 9:15 ` Daniel P. Berrangé
0 siblings, 0 replies; 2+ messages in thread
From: Daniel P. Berrangé @ 2020-09-21 9:15 UTC (permalink / raw)
To: Ani Sinha; +Cc: Paolo Bonzini, qemu-devel, Eduardo Habkost
On Mon, Sep 21, 2020 at 02:37:04PM +0530, Ani Sinha wrote:
> Object property insertion code iterates over an integer to get an unused
> index that can be used as an unique name for an object property. This loop
> increments the integer value indefinitely. Although very unlikely, this can
> still cause an integer overflow.
> In this change, we fix the above code by checking against INT_MAX and making
s/INT/INT16/
> sure that the interger index does not overflow beyond that value. If no
> available index is found, the code would cause an assertion failure. This
> assertion failure is necessary because the callers of the function do not check
> the return value for NULL.
>
> Signed-off-by: Ani Sinha <ani@anisinha.ca>
> ---
> qom/object.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/qom/object.c b/qom/object.c
> index 387efb25eb..9962874598 100644
> --- a/qom/object.c
> +++ b/qom/object.c
> @@ -1166,11 +1166,11 @@ object_property_try_add(Object *obj, const char *name, const char *type,
>
> if (name_len >= 3 && !memcmp(name + name_len - 3, "[*]", 4)) {
> int i;
> - ObjectProperty *ret;
> + ObjectProperty *ret = NULL;
> char *name_no_array = g_strdup(name);
>
> name_no_array[name_len - 3] = '\0';
> - for (i = 0; ; ++i) {
> + for (i = 0; i < INT16_MAX; ++i) {
> char *full_name = g_strdup_printf("%s[%d]", name_no_array, i);
>
> ret = object_property_try_add(obj, full_name, type, get, set,
> @@ -1181,6 +1181,7 @@ object_property_try_add(Object *obj, const char *name, const char *type,
> }
> }
> g_free(name_no_array);
> + assert(ret);
> return ret;
> }
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-09-21 9:16 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-21 9:07 [PATCH v2] qom: code hardening - have bound checking while looping with integer value Ani Sinha
2020-09-21 9:15 ` Daniel P. Berrangé
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.