[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 3/9] slirp: tftp, copy sockaddr_size
From: |
Samuel Thibault |
Subject: |
[Qemu-devel] [PULL 3/9] slirp: tftp, copy sockaddr_size |
Date: |
Sat, 29 Apr 2017 18:47:44 +0200 |
From: Marc-André Lureau <address@hidden>
ASAN detects an "unknown-crash" when running pxe-test:
/ppc64/pxe/spapr-vlan:
=================================================================
==7143==ERROR: AddressSanitizer: unknown-crash on address 0x7f6dcd298d30 at pc
0x55e22218830d bp 0x7f6dcd2989e0 sp 0x7f6dcd2989d0
READ of size 128 at 0x7f6dcd298d30 thread T2
#0 0x55e22218830c in tftp_session_allocate
/home/elmarco/src/qq/slirp/tftp.c:73
#1 0x55e22218a1f8 in tftp_handle_rrq /home/elmarco/src/qq/slirp/tftp.c:289
#2 0x55e22218b54c in tftp_input /home/elmarco/src/qq/slirp/tftp.c:446
#3 0x55e2221833fe in udp6_input /home/elmarco/src/qq/slirp/udp6.c:82
#4 0x55e222137b17 in ip6_input /home/elmarco/src/qq/slirp/ip6_input.c:67
Address 0x7f6dcd298d30 is located in stack of thread T2 at offset 96 in frame
#0 0x55e222182420 in udp6_input /home/elmarco/src/qq/slirp/udp6.c:13
This frame has 3 object(s):
[32, 48) '<unknown>'
[96, 124) 'lhost' <== Memory access at offset 96 partially overflows this
variable
[160, 200) 'save_ip' <== Memory access at offset 96 partially underflows
this variable
The sockaddr_storage pointer is the sockaddr_in6 lhost on the
stack. Copy only the source addr size.
Signed-off-by: Marc-André Lureau <address@hidden>
Reviewed-by: Thomas Huth <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Samuel Thibault <address@hidden>
---
slirp/tftp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/slirp/tftp.c b/slirp/tftp.c
index 50e714807d..a9bc4bb1b6 100644
--- a/slirp/tftp.c
+++ b/slirp/tftp.c
@@ -70,7 +70,7 @@ static int tftp_session_allocate(Slirp *slirp, struct
sockaddr_storage *srcsas,
found:
memset(spt, 0, sizeof(*spt));
- spt->client_addr = *srcsas;
+ memcpy(&spt->client_addr, srcsas, sockaddr_size(srcsas));
spt->fd = -1;
spt->block_size = 512;
spt->client_port = tp->udp.uh_sport;
--
2.11.0
- [Qemu-devel] [PULL 0/9] slirp updates, Samuel Thibault, 2017/04/29
- [Qemu-devel] [PULL 3/9] slirp: tftp, copy sockaddr_size,
Samuel Thibault <=
- [Qemu-devel] [PULL 4/9] slirp: fix pinging the virtual ipv4 DNS server, Samuel Thibault, 2017/04/29
- [Qemu-devel] [PULL 1/9] slirp: allow host port 0 for hostfwd, Samuel Thibault, 2017/04/29
- [Qemu-devel] [PULL 7/9] slirp: Common lhost/fhost union, Samuel Thibault, 2017/04/29
- [Qemu-devel] [PULL 2/9] slirp/smb: Replace constant strings by glib string, Samuel Thibault, 2017/04/29
- [Qemu-devel] [PULL 9/9] slirp: VMStatify remaining except for loop, Samuel Thibault, 2017/04/29
- [Qemu-devel] [PULL 6/9] slirp: VMStatify sbuf, Samuel Thibault, 2017/04/29
- [Qemu-devel] [PULL 8/9] slirp: VMStatify socket level, Samuel Thibault, 2017/04/29
- [Qemu-devel] [PULL 5/9] slirp: VMState conversion; tcpcb, Samuel Thibault, 2017/04/29
- Re: [Qemu-devel] [PULL 0/9] slirp updates, no-reply, 2017/04/29