* [Qemu-devel] [PATCH] tests/virtio-9p: explicitely handle potential integer overflows
@ 2018-01-30 8:32 Greg Kurz
2018-01-30 12:03 ` Stefan Hajnoczi
2018-01-30 13:56 ` Eric Blake
0 siblings, 2 replies; 3+ messages in thread
From: Greg Kurz @ 2018-01-30 8:32 UTC (permalink / raw)
To: qemu-devel; +Cc: Stefan Hajnoczi, Greg Kurz
Signed-off-by: Greg Kurz <groug@kaod.org>
---
tests/virtio-9p-test.c | 31 +++++++++++++++++++++----------
1 file changed, 21 insertions(+), 10 deletions(-)
This is based on SHA1 2eab02aa260ac5405e1e51c9cc1b4c3aa23fc45a from my
9p-next branch:
https://github.com/gkurz/qemu/commits/9p-next
diff --git a/tests/virtio-9p-test.c b/tests/virtio-9p-test.c
index 41fa492cb778..f4824fa33b87 100644
--- a/tests/virtio-9p-test.c
+++ b/tests/virtio-9p-test.c
@@ -168,7 +168,7 @@ static uint16_t v9fs_string_size(const char *string)
{
size_t len = strlen(string);
- g_assert_cmpint(len, <=, UINT16_MAX);
+ g_assert_cmpint(len, <=, UINT16_MAX - 2);
return 2 + len;
}
@@ -209,17 +209,20 @@ static P9Req *v9fs_req_init(QVirtIO9P *v9p, uint32_t size, uint8_t id,
uint16_t tag)
{
P9Req *req = g_new0(P9Req, 1);
- uint32_t t_size = 7 + size; /* 9P header has well-known size of 7 bytes */
+ uint32_t total_size = 7; /* 9P header has well-known size of 7 bytes */
P9Hdr hdr = {
- .size = cpu_to_le32(t_size),
.id = id,
.tag = cpu_to_le16(tag)
};
- g_assert_cmpint(t_size, <=, P9_MAX_SIZE);
+ g_assert_cmpint(total_size, <=, UINT32_MAX - size);
+ total_size += size;
+ hdr.size = cpu_to_le32(total_size);
+
+ g_assert_cmpint(total_size, <=, P9_MAX_SIZE);
req->v9p = v9p;
- req->t_size = t_size;
+ req->t_size = total_size;
req->t_msg = guest_alloc(v9p->qs->alloc, req->t_size);
v9fs_memwrite(req, &hdr, 7);
req->tag = tag;
@@ -305,8 +308,13 @@ static void v9fs_rlerror(P9Req *req, uint32_t *err)
static P9Req *v9fs_tversion(QVirtIO9P *v9p, uint32_t msize, const char *version,
uint16_t tag)
{
- P9Req *req = v9fs_req_init(v9p, 4 + v9fs_string_size(version), P9_TVERSION,
- tag);
+ P9Req *req;
+ uint32_t body_size = 4;
+ uint16_t string_size = v9fs_string_size(version);
+
+ g_assert_cmpint(body_size, <=, UINT32_MAX - string_size);
+ body_size += string_size;
+ req = v9fs_req_init(v9p, body_size, P9_TVERSION, tag);
v9fs_uint32_write(req, msize);
v9fs_string_write(req, version);
@@ -366,12 +374,15 @@ static P9Req *v9fs_twalk(QVirtIO9P *v9p, uint32_t fid, uint32_t newfid,
{
P9Req *req;
int i;
- uint32_t size = 4 + 4 + 2;
+ uint32_t body_size = 4 + 4 + 2;
for (i = 0; i < nwname; i++) {
- size += v9fs_string_size(wnames[i]);
+ uint16_t wname_size = v9fs_string_size(wnames[i]);
+
+ g_assert_cmpint(body_size, <=, UINT32_MAX - wname_size);
+ body_size += wname_size;
}
- req = v9fs_req_init(v9p, size, P9_TWALK, tag);
+ req = v9fs_req_init(v9p, body_size, P9_TWALK, tag);
v9fs_uint32_write(req, fid);
v9fs_uint32_write(req, newfid);
v9fs_uint16_write(req, nwname);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Qemu-devel] [PATCH] tests/virtio-9p: explicitely handle potential integer overflows
2018-01-30 8:32 [Qemu-devel] [PATCH] tests/virtio-9p: explicitely handle potential integer overflows Greg Kurz
@ 2018-01-30 12:03 ` Stefan Hajnoczi
2018-01-30 13:56 ` Eric Blake
1 sibling, 0 replies; 3+ messages in thread
From: Stefan Hajnoczi @ 2018-01-30 12:03 UTC (permalink / raw)
To: Greg Kurz; +Cc: qemu-devel
[-- Attachment #1: Type: text/plain, Size: 436 bytes --]
On Tue, Jan 30, 2018 at 09:32:48AM +0100, Greg Kurz wrote:
> Signed-off-by: Greg Kurz <groug@kaod.org>
> ---
> tests/virtio-9p-test.c | 31 +++++++++++++++++++++----------
> 1 file changed, 21 insertions(+), 10 deletions(-)
>
> This is based on SHA1 2eab02aa260ac5405e1e51c9cc1b4c3aa23fc45a from my
> 9p-next branch:
>
> https://github.com/gkurz/qemu/commits/9p-next
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Qemu-devel] [PATCH] tests/virtio-9p: explicitely handle potential integer overflows
2018-01-30 8:32 [Qemu-devel] [PATCH] tests/virtio-9p: explicitely handle potential integer overflows Greg Kurz
2018-01-30 12:03 ` Stefan Hajnoczi
@ 2018-01-30 13:56 ` Eric Blake
1 sibling, 0 replies; 3+ messages in thread
From: Eric Blake @ 2018-01-30 13:56 UTC (permalink / raw)
To: Greg Kurz, qemu-devel; +Cc: Stefan Hajnoczi
[-- Attachment #1: Type: text/plain, Size: 805 bytes --]
On 01/30/2018 02:32 AM, Greg Kurz wrote:
> Signed-off-by: Greg Kurz <groug@kaod.org>
In the subject: s/explicitely/explicitly/
> ---
> tests/virtio-9p-test.c | 31 +++++++++++++++++++++----------
> 1 file changed, 21 insertions(+), 10 deletions(-)
>
> This is based on SHA1 2eab02aa260ac5405e1e51c9cc1b4c3aa23fc45a from my
> 9p-next branch:
>
> https://github.com/gkurz/qemu/commits/9p-next
I don't think patchew recognizes those sorts of references yet; better
might be:
Based-on: <151675071042.29381.16225631028845063799.stgit@bahia.lan>
([PATCH 0/7] tests: virtio-9p: test request cancellation)
Reviewed-by: Eric Blake <eblake@redhat.com>
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3266
Virtualization: qemu.org | libvirt.org
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 619 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-01-30 15:38 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-01-30 8:32 [Qemu-devel] [PATCH] tests/virtio-9p: explicitely handle potential integer overflows Greg Kurz
2018-01-30 12:03 ` Stefan Hajnoczi
2018-01-30 13:56 ` Eric Blake
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.