Re: [PATCH v2] 9pfs: Fix segfault in do_readdir_many caused by struct dirent overread

From: Christian Schoenebeck <qemu_oss@crudebyte.com>
To: qemu-devel@nongnu.org
Cc: "Dmitry V. Levin" <ldv@altlinux.org>,
	Vitaly Chikunov <vt@altlinux.org>,
	qemu-stable@nongnu.org, Greg Kurz <groug@kaod.org>
Subject: Re: [PATCH v2] 9pfs: Fix segfault in do_readdir_many caused by struct dirent overread
Date: Fri, 04 Feb 2022 13:12:10 +0100	[thread overview]
Message-ID: <2627488.0S70g7mNYN@silver> (raw)
In-Reply-To: <20220204002237.GD7780@altlinux.org>

On Freitag, 4. Februar 2022 01:22:38 CET Dmitry V. Levin wrote:
> On Fri, Feb 04, 2022 at 03:15:16AM +0300, Vitaly Chikunov wrote:
> [...]
> 
> > Yes but this will cause another abort() call. I am thinking about v3 fix
> > 
> > like this:
> >   struct dirent *
> >   qemu_dirent_dup(struct dirent *dent)
> >   {
> >   
> >       size_t sz = 0;
> >   
> >   #if defined _DIRENT_HAVE_D_RECLEN
> >   
> >       /* Avoid use of strlen() if there's d_reclen. */
> >       sz = dent->d_reclen;
> >   
> >   #endif
> >   
> >       if (sz == 0) {
> >       
> >           /* Fallback to the most portable way. */
> >           sz = offsetof(struct dirent, d_name) +
> > 			
> > 			strlen(dent->d_name) + 1;
> > 			
> >       }
> >       struct dirent *dst = g_malloc(sz);
> >       return memcpy(dst, dent, sz);
> >   
> >   }
> > 
> > Thus it will use strlen for simulated dirents and d_reclen for real ones
> 
> Makes sense.

Then maybe consider to leave your reviewed-by tag on today's v3 Dmitry, 
thanks! :)

Best regards,
Christian Schoenebeck