[Qemu-devel] [PATCH v2] qemu-io: reject invalid pattern

[Christoph Hellwig]

Replace the use of atoi which is used for pattern parsing currently with
strtol.  Atoi won't parse sedecimal pattern values (it always returns 0),
but qemu-iotests use such pattern values.  Also reject every pattern
that is not a unsigned char as we pass the pattern to memset which
expect a bye value (despite having the pattern argument declared as int).

Based on an earlier patch by Stefan Weil which did not include the
error handling.


Signed-off-by: Christoph Hellwig <address@hidden>
Reviewed-by: Kevin Wolf <address@hidden>
Reported-by: Stefan Weil <address@hidden>

Index: qemu/qemu-io.c
===================================================================
--- qemu.orig/qemu-io.c 2009-07-20 14:29:31.532907056 +0200
+++ qemu/qemu-io.c      2009-07-20 14:31:25.690150856 +0200
@@ -26,6 +26,28 @@ static BlockDriverState *bs;
 static int misalign;
 
 /*
+ * Parse the pattern argument to various sub-commands.
+ *
+ * Because the pattern is used as an argument to memset it must evaluate
+ * to an unsigned integer that fits into a single byte.
+ *
+ * Returns the pattern byte or -1 in case arg does not contain a valid pattern.
+ */
+static int parse_pattern(const char *arg)
+{
+       char *endptr = NULL;
+       long pattern;
+
+       pattern = strtol(arg, &endptr, 0);
+       if (pattern < 0 || pattern > UCHAR_MAX || *endptr != '\0') {
+               printf("%s is not a valid pattern byte\n", arg);
+               return -1;
+       }
+
+       return pattern;
+}
+
+/*
  * Memory allocation helpers.
  *
  * Make sure memory is aligned by default, or purposefully misaligned if
@@ -304,7 +326,10 @@ read_f(int argc, char **argv)
                        break;
                case 'P':
                        Pflag = 1;
-                       pattern = atoi(optarg);
+                       pattern = parse_pattern(optarg);
+                       if (pattern < 0) {
+                               return 0;
+                       }
                        break;
                case 'q':
                        qflag = 1;
@@ -469,7 +494,10 @@ readv_f(int argc, char **argv)
                        break;
                case 'P':
                        Pflag = 1;
-                       pattern = atoi(optarg);
+                       pattern = parse_pattern(optarg);
+                       if (pattern < 0) {
+                               return 0;
+                       }
                        break;
                case 'q':
                        qflag = 1;
@@ -594,7 +622,10 @@ write_f(int argc, char **argv)
                        pflag = 1;
                        break;
                case 'P':
-                       pattern = atoi(optarg);
+                       pattern = parse_pattern(optarg);
+                       if (pattern < 0) {
+                               return 0;
+                       }
                        break;
                case 'q':
                        qflag = 1;
@@ -721,7 +752,10 @@ writev_f(int argc, char **argv)
                        qflag = 1;
                        break;
                case 'P':
-                       pattern = atoi(optarg);
+                       pattern = parse_pattern(optarg);
+                       if (pattern < 0) {
+                               return 0;
+                       }
                        break;
                default:
                        return command_usage(&writev_cmd);
@@ -895,7 +929,10 @@ aio_read_f(int argc, char **argv)
                        break;
                case 'P':
                        ctx->Pflag = 1;
-                       ctx->pattern = atoi(optarg);
+                       ctx->pattern = parse_pattern(optarg);
+                       if (ctx->pattern < 0) {
+                               return 0;
+                       }
                        break;
                case 'q':
                        ctx->qflag = 1;
@@ -995,7 +1032,10 @@ aio_write_f(int argc, char **argv)
                        ctx->qflag = 1;
                        break;
                case 'P':
-                       pattern = atoi(optarg);
+                       pattern = parse_pattern(optarg);
+                       if (pattern < 0) {
+                               return 0;
+                       }
                        break;
                default:
                        free(ctx);