qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] linux-user: limit number of arguments to execve


From: P J P
Subject: Re: [Qemu-devel] [PATCH] linux-user: limit number of arguments to execve
Date: Mon, 6 Mar 2017 10:56:37 +0530 (IST)

+-- On Fri, 3 Mar 2017, Jann Horn wrote --+
| On Fri, Mar 3, 2017 at 4:55 PM, Peter Maydell <address@hidden> wrote:
| >> +            if (argc > ARG_MAX || envc > ARG_MAX) {
| >> +                fprintf(stderr,
| >> +                        "argc(%d), envc(%d) exceed %d\n", argc, envc, 
ARG_MAX);
| >> +                ret = -TARGET_EFAULT;
| >> +                break;
| >> +            }
| >>              argp = alloca((argc + 1) * sizeof(void *));
| >>              envp = alloca((envc + 1) * sizeof(void *));
| >
| > This code is already supposed to handle "argument string too big",
| > see commit a6f79cc9a5e.
| >
| > What's the actual bug case we're trying to handle here?

Not argument string, but argument count too big leads to a bad address in 
get_user_ual(...), resulting in segfault.

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F



reply via email to

[Prev in Thread] Current Thread [Next in Thread]