From 582c75ec459169ebb465701dfea9c128c01bd1fe Mon Sep 17 00:00:00 2001 From: Eric Blake Date: Wed, 3 Mar 2010 09:31:02 -0700 Subject: [PATCH] uml: sanity check external data before using it Otherwise, a malicious packet could cause a DoS via spurious out-of-memory failure. * src/uml/uml_driver.c (umlMonitorCommand): Validate that incoming data is reliable before using it to allocate/dereference memory. Don't report bogus errno on short read. Reported by Jim Meyering. --- src/uml/uml_driver.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index 31112115c1..1cbd0bd81c 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -734,15 +734,15 @@ static int umlMonitorCommand(const struct uml_driver *driver, if (nbytes < 0) { if (errno == EAGAIN || errno == EINTR) continue; - virReportSystemError(errno, - _("cannot read reply %s"), - cmd); + virReportSystemError(errno, _("cannot read reply %s"), cmd); goto error; } if (nbytes < sizeof res) { - virReportSystemError(errno, - _("incomplete reply %s"), - cmd); + virReportSystemError(0, _("incomplete reply %s"), cmd); + goto error; + } + if (sizeof res.data < res.length) { + virReportSystemError(0, _("invalid length in reply %s"), cmd); goto error; }