From: PRAMOD DEVENDRA Subject: [PATCH v3] libxl/libxl_qmp.c: fix error handling in qmp_open Date: Thu, 19 Mar 2015 12:55:12 +0000 Message-ID: <1426769712-1524-1-git-send-email-pramod.devendra@citrix.com> References: <1426747230-30579-1-git-send-email-pramod.devendra@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Resent-Message-ID: <20150319132544.GA19640@aepfle.de> Resent-To: xen-devel@lists.xen.org Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1YYZz3-0002L4-I2 for xen-devel@lists.xenproject.org; Thu, 19 Mar 2015 12:55:33 +0000 In-Reply-To: <1426747230-30579-1-git-send-email-pramod.devendra@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xenproject.org Cc: Ian Jackson , Wei Liu , Pramod Devendra , Ian Campbell , Stefano Stabellini List-Id: xen-devel@lists.xenproject.org From: Pramod Devendra 1. Make sure sun_path does not overflow 2. Close qmp_fd on error 3. Use goto out for error handling Signed-off-by: Pramod Devendra CC: Ian Jackson CC: Stefano Stabellini CC: Ian Campbell CC: Wei Liu --- tools/libxl/libxl_qmp.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/tools/libxl/libxl_qmp.c b/tools/libxl/libxl_qmp.c index c7324e6..316a93f 100644 --- a/tools/libxl/libxl_qmp.c +++ b/tools/libxl/libxl_qmp.c @@ -357,22 +357,32 @@ static libxl__qmp_handler *qmp_init_handler(libxl__gc *gc, uint32_t domid) static int qmp_open(libxl__qmp_handler *qmp, const char *qmp_socket_path, int timeout) { - int ret; + int ret = -1; int i = 0; qmp->qmp_fd = socket(AF_UNIX, SOCK_STREAM, 0); if (qmp->qmp_fd < 0) { - return -1; + goto out; } ret = libxl_fd_set_nonblock(qmp->ctx, qmp->qmp_fd, 1); - if (ret) return -1; + if (ret) { + ret = -1; + goto out; + } ret = libxl_fd_set_cloexec(qmp->ctx, qmp->qmp_fd, 1); - if (ret) return -1; + if (ret) { + ret = -1; + goto out; + } + if (sizeof (qmp->addr.sun_path) <= strlen(qmp_socket_path)) { + ret = -1; + goto out; + } memset(&qmp->addr, 0, sizeof (qmp->addr)); qmp->addr.sun_family = AF_UNIX; strncpy(qmp->addr.sun_path, qmp_socket_path, - sizeof (qmp->addr.sun_path)); + sizeof (qmp->addr.sun_path)-1); do { ret = connect(qmp->qmp_fd, (struct sockaddr *) &qmp->addr, @@ -384,9 +394,13 @@ static int qmp_open(libxl__qmp_handler *qmp, const char *qmp_socket_path, * ECONNREFUSED : Leftover socket hasn't been removed yet */ continue; } - return -1; + ret = -1; + goto out; } while ((++i / 5 <= timeout) && (usleep(200 * 1000) <= 0)); +out: + if (ret == -1 && qmp->qmp_fd > -1) close(qmp->qmp_fd); + return ret; } -- 1.7.10.4