[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] 9pfs: fix information leak in xattr read
From: |
Greg Kurz |
Subject: |
Re: [Qemu-devel] [PATCH] 9pfs: fix information leak in xattr read |
Date: |
Wed, 28 Sep 2016 10:47:52 +0200 |
On Wed, 28 Sep 2016 14:42:05 +0800
Li Qiang <address@hidden> wrote:
> Hi Greg,
>
> What about this patch?
>
> It seems you have forget it.
>
Heh not exactly... I'm just wondering why we allocate xattr_fidp->fs.xattr.value
here if we don't use it. Can you please investigate if it is possible to defer
allocation until it is really needed ?
Thanks.
--
Greg
> 2016-09-27 12:44 GMT+08:00 Li Qiang <address@hidden>:
>
> > From: Li Qiang <address@hidden>
> >
> > 9pfs uses g_malloc() to allocate the xattr memory space, if the guest
> > reads this memory before writing to it, this will leak host heap
> > memory to the guest. This patch avoid this.
> >
> > Signed-off-by: Li Qiang <address@hidden>
> > ---
> > hw/9pfs/9p.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> > index b1ff8e7..4db1bd8 100644
> > --- a/hw/9pfs/9p.c
> > +++ b/hw/9pfs/9p.c
> > @@ -3291,7 +3291,7 @@ static void v9fs_xattrcreate(void *opaque)
> > xattr_fidp->fs.xattr.flags = flags;
> > v9fs_string_init(&xattr_fidp->fs.xattr.name);
> > v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);
> > - xattr_fidp->fs.xattr.value = g_malloc(size);
> > + xattr_fidp->fs.xattr.value = g_malloc0(size);
> > err = offset;
> > put_fid(pdu, file_fidp);
> > out_nofid:
> > --
> > 1.8.3.1
> >
> >