From a74d283a77219f1b541d7529f03981243da8c739 Mon Sep 17 00:00:00 2001
From: Tim Wiederhake <twiederh@redhat.com>
Date: Mon, 1 Feb 2021 12:27:59 +0100
Subject: [PATCH] commandhelper: Make number of fds variable in parseArguments

Fixes a buffer overflow triggered when more than three "--readfd"
arguments were given on the command line.

Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
---
 tests/commandhelper.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/tests/commandhelper.c b/tests/commandhelper.c
index ac64505461..9f0b7f25ac 100644
--- a/tests/commandhelper.c
+++ b/tests/commandhelper.c
@@ -36,7 +36,7 @@ extern char **environ;
 # define VIR_FROM_THIS VIR_FROM_NONE
 
 struct Arguments {
-    int readfds[3];
+    int *readfds;
     int numreadfds;
     bool daemonize_check;
     bool close_stdin;
@@ -51,6 +51,9 @@ static struct Arguments *parseArguments(int argc, char** argv)
     if (!(args = calloc(1, sizeof(*args))))
         goto cleanup;
 
+    if (!(args->readfds = calloc(1, sizeof(*args->readfds))))
+        goto cleanup;
+
     args->numreadfds = 1;
     args->readfds[0] = STDIN_FILENO;
 
@@ -58,6 +61,12 @@ static struct Arguments *parseArguments(int argc, char** argv)
         if (STREQ(argv[i - 1], "--readfd")) {
             char c;
 
+            args->readfds = realloc(args->readfds,
+                                    (args->numreadfds + 1) *
+                                    sizeof(*args->readfds));
+            if (!args->readfds)
+                goto cleanup;
+
             if (1 != sscanf(argv[i], "%u%c",
                             &args->readfds[args->numreadfds++], &c)) {
                 printf("Could not parse fd %s\n", argv[i]);
@@ -76,7 +85,12 @@ static struct Arguments *parseArguments(int argc, char** argv)
     if (ret == 0)
         return args;
 
-    free(args);
+    if (args) {
+        if (args->readfds)
+            free(args->readfds);
+        free(args);
+    }
+
     return NULL;
 }
 
@@ -343,8 +357,11 @@ int main(int argc, char **argv) {
     ret = EXIT_SUCCESS;
 
  cleanup:
-    if (args)
+    if (args) {
+        if (args->readfds)
+            free(args->readfds);
         free(args);
+    }
     if (log)
         fclose(log);
     return ret;