From 6f5d8671225dc77190647f18a27a0d156d4ca97a Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Tue, 23 Jul 2019 16:17:52 +0530 Subject: [PATCH] qemu-bridge-helper: restrict interface name to IFNAMSIZ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The network interface name in Linux is defined to be of size IFNAMSIZ(=16), including the terminating null('\0') byte. The same is applied to interface names read from 'bridge.conf' file to form ACL rules. If user supplied '--br=bridge' name is not restricted to the same length, it could lead to ACL bypass issue. Restrict interface name to IFNAMSIZ, including null byte. Reported-by: Riccardo Schirone Signed-off-by: Prasad J Pandit Reviewed-by: Stefan Hajnoczi Reviewed-by: Daniel P. Berrangé Reviewed-by: Li Qiang Signed-off-by: Jason Wang --- qemu-bridge-helper.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c index 95624bc300..2058e10454 100644 --- a/qemu-bridge-helper.c +++ b/qemu-bridge-helper.c @@ -119,6 +119,13 @@ static int parse_acl_file(const char *filename, ACLList *acl_list) } *argend = 0; + if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) { + fprintf(stderr, "name `%s' too long: %zu\n", arg, strlen(arg)); + fclose(f); + errno = EINVAL; + return -1; + } + if (strcmp(cmd, "deny") == 0) { acl_rule = g_malloc(sizeof(*acl_rule)); if (strcmp(arg, "all") == 0) { @@ -269,6 +276,10 @@ int main(int argc, char **argv) usage(); return EXIT_FAILURE; } + if (strlen(bridge) >= IFNAMSIZ) { + fprintf(stderr, "name `%s' too long: %zu\n", bridge, strlen(bridge)); + return EXIT_FAILURE; + } /* parse default acl file */ QSIMPLEQ_INIT(&acl_list);