* [PATCH] Fix unsigned integer underflow in fd-trans.c
@ 2019-10-18 0:19 Shu-Chun Weng
2019-10-18 7:26 ` Laurent Vivier
2019-10-21 9:34 ` Laurent Vivier
0 siblings, 2 replies; 6+ messages in thread
From: Shu-Chun Weng @ 2019-10-18 0:19 UTC (permalink / raw)
To: Laurent Vivier; +Cc: Riku Voipio, qemu-devel, Shu-Chun Weng
In any of these `*_for_each_*` functions, the last entry in the buffer (so the
"remaining length in the buffer" `len` is equal to the length of the
entry `nlmsg_len`/`nla_len`/etc) has size that is not a multiple of the
alignment, the aligned lengths `*_ALIGN(*_len)` will be greater than `len`.
Since `len` is unsigned (`size_t`), it underflows and the loop will read
pass the buffer.
This may manifest as random EINVAL or EOPNOTSUPP error on IO or network
system calls.
Signed-off-by: Shu-Chun Weng <scw@google.com>
---
linux-user/fd-trans.c | 51 +++++++++++++++++++++++++++++++++----------
1 file changed, 40 insertions(+), 11 deletions(-)
diff --git a/linux-user/fd-trans.c b/linux-user/fd-trans.c
index 60077ce531..9b92386abf 100644
--- a/linux-user/fd-trans.c
+++ b/linux-user/fd-trans.c
@@ -279,6 +279,7 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
(struct nlmsghdr *))
{
uint32_t nlmsg_len;
+ uint32_t aligned_nlmsg_len;
abi_long ret;
while (len > sizeof(struct nlmsghdr)) {
@@ -312,8 +313,13 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
break;
}
tswap_nlmsghdr(nlh);
- len -= NLMSG_ALIGN(nlmsg_len);
- nlh = (struct nlmsghdr *)(((char*)nlh) + NLMSG_ALIGN(nlmsg_len));
+
+ aligned_nlmsg_len = NLMSG_ALIGN(nlmsg_len);
+ if (aligned_nlmsg_len >= len) {
+ break;
+ }
+ len -= aligned_nlmsg_len;
+ nlh = (struct nlmsghdr *)(((char*)nlh) + aligned_nlmsg_len);
}
return 0;
}
@@ -323,6 +329,7 @@ static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
abi_long (*target_to_host_nlmsg)
(struct nlmsghdr *))
{
+ uint32_t aligned_nlmsg_len;
int ret;
while (len > sizeof(struct nlmsghdr)) {
@@ -349,8 +356,13 @@ static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
return ret;
}
}
- len -= NLMSG_ALIGN(nlh->nlmsg_len);
- nlh = (struct nlmsghdr *)(((char *)nlh) + NLMSG_ALIGN(nlh->nlmsg_len));
+
+ aligned_nlmsg_len = NLMSG_ALIGN(nlh->nlmsg_len);
+ if (aligned_nlmsg_len >= len) {
+ break;
+ }
+ len -= aligned_nlmsg_len;
+ nlh = (struct nlmsghdr *)(((char *)nlh) + aligned_nlmsg_len);
}
return 0;
}
@@ -363,6 +375,7 @@ static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
void *context))
{
unsigned short nla_len;
+ unsigned short aligned_nla_len;
abi_long ret;
while (len > sizeof(struct nlattr)) {
@@ -377,8 +390,13 @@ static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
if (ret < 0) {
return ret;
}
- len -= NLA_ALIGN(nla_len);
- nlattr = (struct nlattr *)(((char *)nlattr) + NLA_ALIGN(nla_len));
+
+ aligned_nla_len = NLA_ALIGN(nla_len);
+ if (aligned_nla_len >= len) {
+ break;
+ }
+ len -= aligned_nla_len;
+ nlattr = (struct nlattr *)(((char *)nlattr) + aligned_nla_len);
}
return 0;
}
@@ -389,6 +407,7 @@ static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
(struct rtattr *))
{
unsigned short rta_len;
+ unsigned short aligned_rta_len;
abi_long ret;
while (len > sizeof(struct rtattr)) {
@@ -403,8 +422,13 @@ static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
if (ret < 0) {
return ret;
}
- len -= RTA_ALIGN(rta_len);
- rtattr = (struct rtattr *)(((char *)rtattr) + RTA_ALIGN(rta_len));
+
+ aligned_rta_len = RTA_ALIGN(rta_len);
+ if (aligned_rta_len >= len) {
+ break;
+ }
+ len -= aligned_rta_len;
+ rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len);
}
return 0;
}
@@ -1058,6 +1082,7 @@ static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
abi_long (*target_to_host_rtattr)
(struct rtattr *))
{
+ unsigned short aligned_rta_len;
abi_long ret;
while (len >= sizeof(struct rtattr)) {
@@ -1071,9 +1096,13 @@ static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
if (ret < 0) {
return ret;
}
- len -= RTA_ALIGN(rtattr->rta_len);
- rtattr = (struct rtattr *)(((char *)rtattr) +
- RTA_ALIGN(rtattr->rta_len));
+
+ aligned_rta_len = RTA_ALIGN(rtattr->rta_len);
+ if (aligned_rta_len >= len) {
+ break;
+ }
+ len -= aligned_rta_len;
+ rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len);
}
return 0;
}
--
2.23.0.866.gb869b98d4c-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] Fix unsigned integer underflow in fd-trans.c
2019-10-18 0:19 [PATCH] Fix unsigned integer underflow in fd-trans.c Shu-Chun Weng
@ 2019-10-18 7:26 ` Laurent Vivier
2019-10-18 18:18 ` Shu-Chun Weng
2019-10-18 18:27 ` Shu-Chun Weng
2019-10-21 9:34 ` Laurent Vivier
1 sibling, 2 replies; 6+ messages in thread
From: Laurent Vivier @ 2019-10-18 7:26 UTC (permalink / raw)
To: Shu-Chun Weng; +Cc: Riku Voipio, qemu-devel
Le 18/10/2019 à 02:19, Shu-Chun Weng a écrit :
> In any of these `*_for_each_*` functions, the last entry in the buffer (so the
> "remaining length in the buffer" `len` is equal to the length of the
> entry `nlmsg_len`/`nla_len`/etc) has size that is not a multiple of the
> alignment, the aligned lengths `*_ALIGN(*_len)` will be greater than `len`.
> Since `len` is unsigned (`size_t`), it underflows and the loop will read
> pass the buffer.
>
> This may manifest as random EINVAL or EOPNOTSUPP error on IO or network
> system calls.
>
> Signed-off-by: Shu-Chun Weng <scw@google.com>
> ---
> linux-user/fd-trans.c | 51 +++++++++++++++++++++++++++++++++----------
> 1 file changed, 40 insertions(+), 11 deletions(-)
>
> diff --git a/linux-user/fd-trans.c b/linux-user/fd-trans.c
> index 60077ce531..9b92386abf 100644
> --- a/linux-user/fd-trans.c
> +++ b/linux-user/fd-trans.c
> @@ -279,6 +279,7 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
> (struct nlmsghdr *))
> {
> uint32_t nlmsg_len;
> + uint32_t aligned_nlmsg_len;
> abi_long ret;
>
> while (len > sizeof(struct nlmsghdr)) {
> @@ -312,8 +313,13 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
> break;
> }
> tswap_nlmsghdr(nlh);
> - len -= NLMSG_ALIGN(nlmsg_len);
> - nlh = (struct nlmsghdr *)(((char*)nlh) + NLMSG_ALIGN(nlmsg_len));
> +
> + aligned_nlmsg_len = NLMSG_ALIGN(nlmsg_len);
> + if (aligned_nlmsg_len >= len) {
> + break;
> + }
> + len -= aligned_nlmsg_len;
> + nlh = (struct nlmsghdr *)(((char*)nlh) + aligned_nlmsg_len);
> }
> return 0;
> }
Nice catch.
But the first "if" in the loop is already here for that, we only need to
fix it with something like that in all the for_each functions:
@@ -285,7 +285,7 @@ static abi_long host_to_target_for_each_nlmsg(struct
nlmsghdr *nlh,
nlmsg_len = nlh->nlmsg_len;
if (nlmsg_len < sizeof(struct nlmsghdr) ||
- nlmsg_len > len) {
+ NLMSG_ALIGN(nlmsg_len) > len) {
break;
}
Thanks,
Laurent
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Fix unsigned integer underflow in fd-trans.c
2019-10-18 7:26 ` Laurent Vivier
@ 2019-10-18 18:18 ` Shu-Chun Weng
2019-10-18 18:27 ` Shu-Chun Weng
1 sibling, 0 replies; 6+ messages in thread
From: Shu-Chun Weng @ 2019-10-18 18:18 UTC (permalink / raw)
To: Laurent Vivier; +Cc: Riku Voipio, qemu-devel
[-- Attachment #1.1: Type: text/plain, Size: 3017 bytes --]
That does prevent the integer underflow, but it also changes the behavior
and I don't think the new behavior is desirable.
If the extra payload has a smaller alignment than the header, it makes
sense for the user program to generate a nlmsg_len that is not a multiple
of the alignment. When it's the last entry, the new condition will it
because NLMSG_ALIGN pushes the aligned length over `len`, yet the single
entry processing function won't actually read beyond the buffer as long as
it's bounded by nlmsg_len.
Shu-Chun
On Fri, Oct 18, 2019 at 12:26 AM Laurent Vivier <laurent@vivier.eu> wrote:
> Le 18/10/2019 à 02:19, Shu-Chun Weng a écrit :
> > In any of these `*_for_each_*` functions, the last entry in the buffer
> (so the
> > "remaining length in the buffer" `len` is equal to the length of the
> > entry `nlmsg_len`/`nla_len`/etc) has size that is not a multiple of the
> > alignment, the aligned lengths `*_ALIGN(*_len)` will be greater than
> `len`.
> > Since `len` is unsigned (`size_t`), it underflows and the loop will read
> > pass the buffer.
> >
> > This may manifest as random EINVAL or EOPNOTSUPP error on IO or network
> > system calls.
> >
> > Signed-off-by: Shu-Chun Weng <scw@google.com>
> > ---
> > linux-user/fd-trans.c | 51 +++++++++++++++++++++++++++++++++----------
> > 1 file changed, 40 insertions(+), 11 deletions(-)
> >
> > diff --git a/linux-user/fd-trans.c b/linux-user/fd-trans.c
> > index 60077ce531..9b92386abf 100644
> > --- a/linux-user/fd-trans.c
> > +++ b/linux-user/fd-trans.c
> > @@ -279,6 +279,7 @@ static abi_long host_to_target_for_each_nlmsg(struct
> nlmsghdr *nlh,
> > (struct nlmsghdr
> *))
> > {
> > uint32_t nlmsg_len;
> > + uint32_t aligned_nlmsg_len;
> > abi_long ret;
> >
> > while (len > sizeof(struct nlmsghdr)) {
> > @@ -312,8 +313,13 @@ static abi_long
> host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
> > break;
> > }
> > tswap_nlmsghdr(nlh);
> > - len -= NLMSG_ALIGN(nlmsg_len);
> > - nlh = (struct nlmsghdr *)(((char*)nlh) +
> NLMSG_ALIGN(nlmsg_len));
> > +
> > + aligned_nlmsg_len = NLMSG_ALIGN(nlmsg_len);
> > + if (aligned_nlmsg_len >= len) {
> > + break;
> > + }
> > + len -= aligned_nlmsg_len;
> > + nlh = (struct nlmsghdr *)(((char*)nlh) + aligned_nlmsg_len);
> > }
> > return 0;
> > }
>
> Nice catch.
>
> But the first "if" in the loop is already here for that, we only need to
> fix it with something like that in all the for_each functions:
>
> @@ -285,7 +285,7 @@ static abi_long host_to_target_for_each_nlmsg(struct
> nlmsghdr *nlh,
>
> nlmsg_len = nlh->nlmsg_len;
> if (nlmsg_len < sizeof(struct nlmsghdr) ||
> - nlmsg_len > len) {
> + NLMSG_ALIGN(nlmsg_len) > len) {
> break;
> }
>
> Thanks,
> Laurent
>
>
[-- Attachment #1.2: Type: text/html, Size: 3822 bytes --]
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4837 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Fix unsigned integer underflow in fd-trans.c
2019-10-18 7:26 ` Laurent Vivier
2019-10-18 18:18 ` Shu-Chun Weng
@ 2019-10-18 18:27 ` Shu-Chun Weng
2019-10-18 18:54 ` Laurent Vivier
1 sibling, 1 reply; 6+ messages in thread
From: Shu-Chun Weng @ 2019-10-18 18:27 UTC (permalink / raw)
To: Laurent Vivier; +Cc: Riku Voipio, qemu-devel
[-- Attachment #1: Type: text/plain, Size: 3089 bytes --]
(Re-sending to the list because I forgot to turn off HTML before and
it was bounced.)
That does prevent the integer underflow, but it also changes the
behavior and I don't think the new behavior is desirable.
If the extra payload has a smaller alignment than the header, it makes
sense for the user program to generate a nlmsg_len that is not a
multiple of the alignment. When it's the last entry, the new condition
will it because NLMSG_ALIGN pushes the aligned length over `len`, yet
the single entry processing function won't actually read beyond the
buffer as long as it's bounded by nlmsg_len.
Shu-Chun
On Fri, Oct 18, 2019 at 12:26 AM Laurent Vivier <laurent@vivier.eu> wrote:
>
> Le 18/10/2019 à 02:19, Shu-Chun Weng a écrit :
> > In any of these `*_for_each_*` functions, the last entry in the buffer (so the
> > "remaining length in the buffer" `len` is equal to the length of the
> > entry `nlmsg_len`/`nla_len`/etc) has size that is not a multiple of the
> > alignment, the aligned lengths `*_ALIGN(*_len)` will be greater than `len`.
> > Since `len` is unsigned (`size_t`), it underflows and the loop will read
> > pass the buffer.
> >
> > This may manifest as random EINVAL or EOPNOTSUPP error on IO or network
> > system calls.
> >
> > Signed-off-by: Shu-Chun Weng <scw@google.com>
> > ---
> > linux-user/fd-trans.c | 51 +++++++++++++++++++++++++++++++++----------
> > 1 file changed, 40 insertions(+), 11 deletions(-)
> >
> > diff --git a/linux-user/fd-trans.c b/linux-user/fd-trans.c
> > index 60077ce531..9b92386abf 100644
> > --- a/linux-user/fd-trans.c
> > +++ b/linux-user/fd-trans.c
> > @@ -279,6 +279,7 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
> > (struct nlmsghdr *))
> > {
> > uint32_t nlmsg_len;
> > + uint32_t aligned_nlmsg_len;
> > abi_long ret;
> >
> > while (len > sizeof(struct nlmsghdr)) {
> > @@ -312,8 +313,13 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
> > break;
> > }
> > tswap_nlmsghdr(nlh);
> > - len -= NLMSG_ALIGN(nlmsg_len);
> > - nlh = (struct nlmsghdr *)(((char*)nlh) + NLMSG_ALIGN(nlmsg_len));
> > +
> > + aligned_nlmsg_len = NLMSG_ALIGN(nlmsg_len);
> > + if (aligned_nlmsg_len >= len) {
> > + break;
> > + }
> > + len -= aligned_nlmsg_len;
> > + nlh = (struct nlmsghdr *)(((char*)nlh) + aligned_nlmsg_len);
> > }
> > return 0;
> > }
>
> Nice catch.
>
> But the first "if" in the loop is already here for that, we only need to
> fix it with something like that in all the for_each functions:
>
> @@ -285,7 +285,7 @@ static abi_long host_to_target_for_each_nlmsg(struct
> nlmsghdr *nlh,
>
> nlmsg_len = nlh->nlmsg_len;
> if (nlmsg_len < sizeof(struct nlmsghdr) ||
> - nlmsg_len > len) {
> + NLMSG_ALIGN(nlmsg_len) > len) {
> break;
> }
>
> Thanks,
> Laurent
>
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4837 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Fix unsigned integer underflow in fd-trans.c
2019-10-18 18:27 ` Shu-Chun Weng
@ 2019-10-18 18:54 ` Laurent Vivier
0 siblings, 0 replies; 6+ messages in thread
From: Laurent Vivier @ 2019-10-18 18:54 UTC (permalink / raw)
To: Shu-Chun Weng; +Cc: Riku Voipio, qemu-devel
Le 18/10/2019 à 20:27, Shu-Chun Weng a écrit :
> (Re-sending to the list because I forgot to turn off HTML before and
> it was bounced.)
>
> That does prevent the integer underflow, but it also changes the
> behavior and I don't think the new behavior is desirable.
>
> If the extra payload has a smaller alignment than the header, it makes
> sense for the user program to generate a nlmsg_len that is not a
> multiple of the alignment. When it's the last entry, the new condition
> will it because NLMSG_ALIGN pushes the aligned length over `len`, yet
> the single entry processing function won't actually read beyond the
> buffer as long as it's bounded by nlmsg_len.
Yes, you're right.
So I think your patch is correct.
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Thanks,
Laurent
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Fix unsigned integer underflow in fd-trans.c
2019-10-18 0:19 [PATCH] Fix unsigned integer underflow in fd-trans.c Shu-Chun Weng
2019-10-18 7:26 ` Laurent Vivier
@ 2019-10-21 9:34 ` Laurent Vivier
1 sibling, 0 replies; 6+ messages in thread
From: Laurent Vivier @ 2019-10-21 9:34 UTC (permalink / raw)
To: Shu-Chun Weng; +Cc: Riku Voipio, qemu-devel
Le 18/10/2019 à 02:19, Shu-Chun Weng a écrit :
> In any of these `*_for_each_*` functions, the last entry in the buffer (so the
> "remaining length in the buffer" `len` is equal to the length of the
> entry `nlmsg_len`/`nla_len`/etc) has size that is not a multiple of the
> alignment, the aligned lengths `*_ALIGN(*_len)` will be greater than `len`.
> Since `len` is unsigned (`size_t`), it underflows and the loop will read
> pass the buffer.
>
> This may manifest as random EINVAL or EOPNOTSUPP error on IO or network
> system calls.
>
> Signed-off-by: Shu-Chun Weng <scw@google.com>
> ---
> linux-user/fd-trans.c | 51 +++++++++++++++++++++++++++++++++----------
> 1 file changed, 40 insertions(+), 11 deletions(-)
>
> diff --git a/linux-user/fd-trans.c b/linux-user/fd-trans.c
> index 60077ce531..9b92386abf 100644
> --- a/linux-user/fd-trans.c
> +++ b/linux-user/fd-trans.c
> @@ -279,6 +279,7 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
> (struct nlmsghdr *))
> {
> uint32_t nlmsg_len;
> + uint32_t aligned_nlmsg_len;
> abi_long ret;
>
> while (len > sizeof(struct nlmsghdr)) {
> @@ -312,8 +313,13 @@ static abi_long host_to_target_for_each_nlmsg(struct nlmsghdr *nlh,
> break;
> }
> tswap_nlmsghdr(nlh);
> - len -= NLMSG_ALIGN(nlmsg_len);
> - nlh = (struct nlmsghdr *)(((char*)nlh) + NLMSG_ALIGN(nlmsg_len));
> +
> + aligned_nlmsg_len = NLMSG_ALIGN(nlmsg_len);
> + if (aligned_nlmsg_len >= len) {
> + break;
> + }
> + len -= aligned_nlmsg_len;
> + nlh = (struct nlmsghdr *)(((char*)nlh) + aligned_nlmsg_len);
> }
> return 0;
> }
> @@ -323,6 +329,7 @@ static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
> abi_long (*target_to_host_nlmsg)
> (struct nlmsghdr *))
> {
> + uint32_t aligned_nlmsg_len;
> int ret;
>
> while (len > sizeof(struct nlmsghdr)) {
> @@ -349,8 +356,13 @@ static abi_long target_to_host_for_each_nlmsg(struct nlmsghdr *nlh,
> return ret;
> }
> }
> - len -= NLMSG_ALIGN(nlh->nlmsg_len);
> - nlh = (struct nlmsghdr *)(((char *)nlh) + NLMSG_ALIGN(nlh->nlmsg_len));
> +
> + aligned_nlmsg_len = NLMSG_ALIGN(nlh->nlmsg_len);
> + if (aligned_nlmsg_len >= len) {
> + break;
> + }
> + len -= aligned_nlmsg_len;
> + nlh = (struct nlmsghdr *)(((char *)nlh) + aligned_nlmsg_len);
> }
> return 0;
> }
> @@ -363,6 +375,7 @@ static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
> void *context))
> {
> unsigned short nla_len;
> + unsigned short aligned_nla_len;
> abi_long ret;
>
> while (len > sizeof(struct nlattr)) {
> @@ -377,8 +390,13 @@ static abi_long host_to_target_for_each_nlattr(struct nlattr *nlattr,
> if (ret < 0) {
> return ret;
> }
> - len -= NLA_ALIGN(nla_len);
> - nlattr = (struct nlattr *)(((char *)nlattr) + NLA_ALIGN(nla_len));
> +
> + aligned_nla_len = NLA_ALIGN(nla_len);
> + if (aligned_nla_len >= len) {
> + break;
> + }
> + len -= aligned_nla_len;
> + nlattr = (struct nlattr *)(((char *)nlattr) + aligned_nla_len);
> }
> return 0;
> }
> @@ -389,6 +407,7 @@ static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
> (struct rtattr *))
> {
> unsigned short rta_len;
> + unsigned short aligned_rta_len;
> abi_long ret;
>
> while (len > sizeof(struct rtattr)) {
> @@ -403,8 +422,13 @@ static abi_long host_to_target_for_each_rtattr(struct rtattr *rtattr,
> if (ret < 0) {
> return ret;
> }
> - len -= RTA_ALIGN(rta_len);
> - rtattr = (struct rtattr *)(((char *)rtattr) + RTA_ALIGN(rta_len));
> +
> + aligned_rta_len = RTA_ALIGN(rta_len);
> + if (aligned_rta_len >= len) {
> + break;
> + }
> + len -= aligned_rta_len;
> + rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len);
> }
> return 0;
> }
> @@ -1058,6 +1082,7 @@ static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
> abi_long (*target_to_host_rtattr)
> (struct rtattr *))
> {
> + unsigned short aligned_rta_len;
> abi_long ret;
>
> while (len >= sizeof(struct rtattr)) {
> @@ -1071,9 +1096,13 @@ static abi_long target_to_host_for_each_rtattr(struct rtattr *rtattr,
> if (ret < 0) {
> return ret;
> }
> - len -= RTA_ALIGN(rtattr->rta_len);
> - rtattr = (struct rtattr *)(((char *)rtattr) +
> - RTA_ALIGN(rtattr->rta_len));
> +
> + aligned_rta_len = RTA_ALIGN(rtattr->rta_len);
> + if (aligned_rta_len >= len) {
> + break;
> + }
> + len -= aligned_rta_len;
> + rtattr = (struct rtattr *)(((char *)rtattr) + aligned_rta_len);
> }
> return 0;
> }
>
Applied to my linux-user branch.
Thanks,
Laurent
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-10-21 9:36 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-18 0:19 [PATCH] Fix unsigned integer underflow in fd-trans.c Shu-Chun Weng
2019-10-18 7:26 ` Laurent Vivier
2019-10-18 18:18 ` Shu-Chun Weng
2019-10-18 18:27 ` Shu-Chun Weng
2019-10-18 18:54 ` Laurent Vivier
2019-10-21 9:34 ` Laurent Vivier
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.