[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2] qom: code hardening - have bound checking while looping w
From: |
Daniel P . Berrangé |
Subject: |
Re: [PATCH v2] qom: code hardening - have bound checking while looping with integer value |
Date: |
Mon, 21 Sep 2020 10:15:40 +0100 |
User-agent: |
Mutt/1.14.6 (2020-07-11) |
On Mon, Sep 21, 2020 at 02:37:04PM +0530, Ani Sinha wrote:
> Object property insertion code iterates over an integer to get an unused
> index that can be used as an unique name for an object property. This loop
> increments the integer value indefinitely. Although very unlikely, this can
> still cause an integer overflow.
> In this change, we fix the above code by checking against INT_MAX and making
s/INT/INT16/
> sure that the interger index does not overflow beyond that value. If no
> available index is found, the code would cause an assertion failure. This
> assertion failure is necessary because the callers of the function do not
> check
> the return value for NULL.
>
> Signed-off-by: Ani Sinha <ani@anisinha.ca>
> ---
> qom/object.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/qom/object.c b/qom/object.c
> index 387efb25eb..9962874598 100644
> --- a/qom/object.c
> +++ b/qom/object.c
> @@ -1166,11 +1166,11 @@ object_property_try_add(Object *obj, const char
> *name, const char *type,
>
> if (name_len >= 3 && !memcmp(name + name_len - 3, "[*]", 4)) {
> int i;
> - ObjectProperty *ret;
> + ObjectProperty *ret = NULL;
> char *name_no_array = g_strdup(name);
>
> name_no_array[name_len - 3] = '\0';
> - for (i = 0; ; ++i) {
> + for (i = 0; i < INT16_MAX; ++i) {
> char *full_name = g_strdup_printf("%s[%d]", name_no_array, i);
>
> ret = object_property_try_add(obj, full_name, type, get, set,
> @@ -1181,6 +1181,7 @@ object_property_try_add(Object *obj, const char *name,
> const char *type,
> }
> }
> g_free(name_no_array);
> + assert(ret);
> return ret;
> }
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|