[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] 9pfs: fix integer overflow issue in xattr read/writ
From: |
Li Qiang |
Subject: |
[Qemu-devel] [PATCH] 9pfs: fix integer overflow issue in xattr read/write |
Date: |
Tue, 11 Oct 2016 21:29:19 -0700 |
From: Li Qiang <address@hidden>
In 9pfs xattr read/write function, it mix to use unsigned/signed
,32/64 bits integers. This will causes oob read/write issues. This
patch fix this.
Signed-off-by: Li Qiang <address@hidden>
---
hw/9pfs/9p.c | 29 +++++++++++++----------------
1 file changed, 13 insertions(+), 16 deletions(-)
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index e4040dc..8b50bfb 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -1642,21 +1642,21 @@ static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu,
V9fsFidState *fidp,
{
ssize_t err;
size_t offset = 7;
- int read_count;
- int64_t xattr_len;
+ uint64_t read_count;
+ uint64_t xattr_len;
V9fsVirtioState *v = container_of(s, V9fsVirtioState, state);
VirtQueueElement *elem = v->elems[pdu->idx];
xattr_len = fidp->fs.xattr.len;
+ if (xattr_len < off) {
+ read_count = 0;
+ goto over_read_count;
+ }
read_count = xattr_len - off;
if (read_count > max_count) {
read_count = max_count;
- } else if (read_count < 0) {
- /*
- * read beyond XATTR value
- */
- read_count = 0;
}
+over_read_count:
err = pdu_marshal(pdu, offset, "d", read_count);
if (err < 0) {
return err;
@@ -1982,22 +1982,19 @@ static int v9fs_xattr_write(V9fsState *s, V9fsPDU *pdu,
V9fsFidState *fidp,
{
int i, to_copy;
ssize_t err = 0;
- int write_count;
- int64_t xattr_len;
+ uint64_t write_count;
+ uint64_t xattr_len;
size_t offset = 7;
xattr_len = fidp->fs.xattr.len;
+ if (xattr_len < off) {
+ err = -ENOSPC;
+ goto out;
+ }
write_count = xattr_len - off;
if (write_count > count) {
write_count = count;
- } else if (write_count < 0) {
- /*
- * write beyond XATTR value len specified in
- * xattrcreate
- */
- err = -ENOSPC;
- goto out;
}
err = pdu_marshal(pdu, offset, "d", write_count);
if (err < 0) {
--
1.8.3.1
- [Qemu-devel] [PATCH] 9pfs: fix integer overflow issue in xattr read/write,
Li Qiang <=