From cf070d7ec0b8fb21faa9a630ed5cc66f90844a08 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 20 Jul 2009 01:19:25 +0200 Subject: [PATCH] qemu-io: reject invalid pattern Replace the use of atoi which is used for pattern parsing currently with strtol. Atoi won't parse sedecimal pattern values (it always returns 0), but qemu-iotests use such pattern values. Also reject every pattern that is not a unsigned char as we pass the pattern to memset which expect a bye value (despite having the pattern argument declared as int). Based on an earlier patch by Stefan Weil which did not include the error handling. Signed-off-by: Christoph Hellwig Reported-by: Stefan Weil Signed-off-by: Anthony Liguori --- qemu-io.c | 44 ++++++++++++++++++++++++++++++++++++++------ 1 file changed, 38 insertions(+), 6 deletions(-) diff --git a/qemu-io.c b/qemu-io.c index f9385751d2..029ee0b6e0 100644 --- a/qemu-io.c +++ b/qemu-io.c @@ -25,6 +25,26 @@ static BlockDriverState *bs; static int misalign; +/* + * Parse the pattern argument to various sub-commands. + * + * Because the pattern is used as an argument to memset it must evaluate + * to an unsigned integer that fits into a single byte. + */ +static int parse_pattern(const char *arg) +{ + char *endptr = NULL; + long pattern; + + pattern = strtol(arg, &endptr, 0); + if (pattern < 0 || pattern > UCHAR_MAX || *endptr != '\0') { + printf("%s is not a valid pattern byte\n", arg); + return -1; + } + + return pattern; +} + /* * Memory allocation helpers. * @@ -304,7 +324,9 @@ read_f(int argc, char **argv) break; case 'P': Pflag = 1; - pattern = atoi(optarg); + pattern = parse_pattern(optarg); + if (pattern < 0) + return 0; break; case 'q': qflag = 1; @@ -469,7 +491,9 @@ readv_f(int argc, char **argv) break; case 'P': Pflag = 1; - pattern = atoi(optarg); + pattern = parse_pattern(optarg); + if (pattern < 0) + return 0; break; case 'q': qflag = 1; @@ -594,7 +618,9 @@ write_f(int argc, char **argv) pflag = 1; break; case 'P': - pattern = atoi(optarg); + pattern = parse_pattern(optarg); + if (pattern < 0) + return 0; break; case 'q': qflag = 1; @@ -721,7 +747,9 @@ writev_f(int argc, char **argv) qflag = 1; break; case 'P': - pattern = atoi(optarg); + pattern = parse_pattern(optarg); + if (pattern < 0) + return 0; break; default: return command_usage(&writev_cmd); @@ -895,7 +923,9 @@ aio_read_f(int argc, char **argv) break; case 'P': ctx->Pflag = 1; - ctx->pattern = atoi(optarg); + ctx->pattern = parse_pattern(optarg); + if (ctx->pattern < 0) + return 0; break; case 'q': ctx->qflag = 1; @@ -995,7 +1025,9 @@ aio_write_f(int argc, char **argv) ctx->qflag = 1; break; case 'P': - pattern = atoi(optarg); + pattern = parse_pattern(optarg); + if (pattern < 0) + return 0; break; default: free(ctx);