External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-03-07 17:28:15 +00:00
Code

qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748)

Browse Source 
We read from QEMU until seeing a \r\n pair to indicate a completed reply
or event. To avoid memory denial-of-service though, we must have a size
limit on amount of data we buffer. 10 MB is large enough that it ought
to cope with normal QEMU replies, and small enough that we're not
consuming unreasonable mem.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2018-01-16 17:00:11 +00:00
parent ff609286a7
commit bc251ea91b
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/qemu/qemu_monitor.c
View File

@ -55,6 +55,15 @@ VIR_LOG_INIT("qemu.qemu_monitor");
#define DEBUG_IO 0
#define DEBUG_RAW_IO 0
/* We read from QEMU until seeing a \r\n pair to indicate a
* completed reply or event. To avoid memory denial-of-service
* though, we must have a size limit on amount of data we
* buffer. 10 MB is large enough that it ought to cope with
* normal QEMU replies, and small enough that we're not
* consuming unreasonable mem.
*/
#define QEMU_MONITOR_MAX_RESPONSE (10 * 1024 * 1024)
struct _qemuMonitor {
virObjectLockable parent;
@ -575,6 +584,12 @@ qemuMonitorIORead(qemuMonitorPtr mon)
int ret = 0;
if (avail < 1024) {
if (mon->bufferLength >= QEMU_MONITOR_MAX_RESPONSE) {
virReportSystemError(ERANGE,
_("No complete monitor response found in %d bytes"),
QEMU_MONITOR_MAX_RESPONSE);
return -1;
}
if (VIR_REALLOC_N(mon->buffer,
mon->bufferLength + 1024) < 0)
return -1;