Skip to contentSkip to conversation

qemu-kvm: avoid strlen of NULL pointer

PATCH Superseded Jens Osterkamp 2 participants 2 messages Mar 3, 2010 – Mar 27, 2010

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 qemu-kvm: avoid strlen of NULL pointer

If the user wants to create a chardev of type socket but forgets to give a host= option, qemu_opt_get returns NULL. This NULL pointer is then fed into strlen a few lines below without a check which results in a segfault. This fixes it.

---
 qemu-sockets.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
qemu-sockets.c +3 -0
index 23c3def..a191304 100644
@@ -137,6 +137,9 @@ int inet_listen_opts(QemuOpts *opts, int port_offset)
     pstrcpy(port, sizeof(port), qemu_opt_get(opts, "port"));
     addr = qemu_opt_get(opts, "host");
 
+    if (!addr)
+	    return -1;
+
     to = qemu_opt_get_number(opts, "to", 0);
     if (qemu_opt_get_bool(opts, "ipv4", 0))
         ai.ai_family = PF_INET;
Signature · 13 lines
1.5.6.3


-- 
Best regards, 

Jens Osterkamp
--------------------------------------------------------------------------------
IBM Deutschland Research & Development GmbH
Vorsitzender des Aufsichtsrats: Martin Jetter
Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen
Registergericht: Amtsgericht Stuttgart, HRB 243294
#1 lore raw
Quoted 4 lines · Jens Osterkamp

If the user wants to create a chardev of type socket but forgets to give a host= option, qemu_opt_get returns NULL. This NULL pointer is then fed into strlen a few lines below without a check which results in a segfault. This fixes it.

While this correctly fixes the segfault, it doesn't output any error message. The best would probably be to fold that with the test of "port", as the error message already mentions "host and/or port".

Quoted 37 lines
---
 qemu-sockets.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
qemu-sockets.c +3 -0
index 23c3def..a191304 100644
@@ -137,6 +137,9 @@ int inet_listen_opts(QemuOpts *opts, int port_offset)
     pstrcpy(port, sizeof(port), qemu_opt_get(opts, "port"));
     addr = qemu_opt_get(opts, "host");
 
+    if (!addr)
+	    return -1;
+
     to = qemu_opt_get_number(opts, "to", 0);
     if (qemu_opt_get_bool(opts, "ipv4", 0))
         ai.ai_family = PF_INET;
Signature · 13 lines
1.5.6.3


-- 
Best regards, 

Jens Osterkamp
--------------------------------------------------------------------------------
IBM Deutschland Research & Development GmbH
Vorsitzender des Aufsichtsrats: Martin Jetter
Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen
Registergericht: Amtsgericht Stuttgart, HRB 243294
Signature · 2 lines
Aurelien Jarno                          GPG: 1024D/F1BCDB73
[email protected]                 http://www.aurel32.net